How does the attacker get bad code into an @php code block?
foo onclick=evilCode() does not contain anything that should be escaped.
Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.
Hello, I've found this article about XSS vulnerability.
blog.nette.org/en/quiz-can-you-defend-against-xss-vulnerability
Could someone explain me please, why Laravel blade doesn't offer this kind of protection out of the box? Or could you please give me some advices of how to prevent this (packages, helper functions etc.)
Because when i really tried this code: @php($str = "foo onclick=evilCode()") <input value={{ $str }}>
It doesn't escape and I need to find solution for this. Possible solution is to use some helper functions inside {{ helper($xxx) }}, but I just wanted to make it automatically. Thank you !
Please or to participate in this conversation.