Support the ongoing development of Laravel.io →
Blade Forms
Last updated 1 year ago.
0

Well in that example you have triple { and } I'm getting confused what are your output exactly. Maybe you can be more specific?

Last updated 1 year ago.
0

@araceus2000 i'm outputing just DB query, nothing more than that, but if someone puts <script>alert();</script> i can escape it with {{{ right? And this works fine on my local enviroment, but when i use this code on production side, it triggers this Javascript alert() function.

Last updated 1 year ago.
0

I'm still confused.

Okey the thing is are you showing the query in screen? And only want to show it in some cases?

I don't know if this is going to help you but I use this when I make a return and want to run a different function when the page is ready maybe you can use it or change the if for other cases when you want to use the alert.

 @if(Session::has('return'))
        <script>
            $(function() {
                {{Session::get('return')}}
            });
        </script>
    @endif
Last updated 1 year ago.
0

I think the question being asked is simply: {{{}}} is working locally for escaping user submitted content when echoing to the screen, but it isn't working when pushed to development. So user content of malicious <script></script> Tag submitted by a user still bears the html tags even when {{{}}} is used to echo the content back.

As for an answer... Sorry!

Last updated 1 year ago.
0

Yes @opb, and the problem is solved. I don't know how, but it just worked after few hours of struggle.

Last updated 1 year ago.
0

Sign in to participate in this thread!

Eventy

Your banner here too?

Moderators

We'd like to thank these amazing companies for supporting us

Your logo here?

Laravel.io

The Laravel portal for problem solving, knowledge sharing and community building.

© 2024 Laravel.io - All rights reserved.