Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

LeMatosDeFuk's avatar

Laravel blade XSS vulnerability

Hello, I've found this article about XSS vulnerability.

blog.nette.org/en/quiz-can-you-defend-against-xss-vulnerability

Could someone explain me please, why Laravel blade doesn't offer this kind of protection out of the box? Or could you please give me some advices of how to prevent this (packages, helper functions etc.)

Because when i really tried this code: @php($str = "foo onclick=evilCode()") <input value={{ $str }}>

It doesn't escape and I need to find solution for this. Possible solution is to use some helper functions inside {{ helper($xxx) }}, but I just wanted to make it automatically. Thank you !

0 likes
1 reply
Snapey's avatar

How does the attacker get bad code into an @php code block?

foo onclick=evilCode() does not contain anything that should be escaped.

Please or to participate in this conversation.