Laravel XSS Prevention Guide: Blade Escaping, {!! !!} Risks & CSP Headers

The Problem

How to Fix

1. 1

   Always use escaped Blade output

   Use {{ }} (double curly braces) for all user-generated content. This automatically HTML-encodes the output:

   {{-- SAFE - output is escaped --}}
   <p>{{ $user->name }}</p>
   <p>{{ $comment->body }}</p>

   {{-- VULNERABLE - output is raw/unescaped --}}
   <p>{!! $user->bio !!}</p>

   Only use {!! !!} for content you have explicitly sanitized or that you generated yourself (like rendered Markdown from trusted sources).

2. 2

   Sanitize HTML when you must allow it

   If you need to allow HTML (rich text editors, Markdown), sanitize it before storage and display:

   composer require mews/purifier

   Then sanitize on input:

   use Mews\Purifier\Facades\Purifier;

   $cleanHtml = Purifier::clean($request->input('body'));
   $post->body = $cleanHtml;

   Configure allowed tags in config/purifier.php:

   'HTML.Allowed' => 'p,br,b,i,strong,em,a[href],ul,ol,li,h2,h3,blockquote,pre,code',

   Always sanitize on input (before saving) and still use {!! !!} only with sanitized content.

3. 3

   Handle JavaScript context safely

   Never output user data directly into JavaScript:

   {{-- VULNERABLE --}}
   <script>
   var name = '{{ $user->name }}';
   </script>

   {{-- SAFE - use @json which applies JSON encoding --}}
   <script>
   var name = @json($user->name);
   var userData = @json($user->only(['name', 'email']));
   </script>

   The @json directive properly escapes data for JavaScript contexts, preventing injection through string breakout.

4. 4

   Add Content-Security-Policy header

   Add a CSP header to prevent inline script execution, which blocks most XSS attacks even if a vulnerability exists:

   Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'

   With CSP in place, injected scripts cannot execute because the browser blocks inline JavaScript. This provides defense-in-depth alongside proper output encoding.

   See the missing-security-headers guide for full middleware implementation.

How to Verify

<script>alert('xss')</script>
<img src=x onerror=alert('xss')>
<svg onload=alert('xss')>

Prevention

Frequently Asked Questions