Go offline with the Player FM app!
Understanding how Stringable works inside Blade views
Manage episode 484483414 series 2974897
Joel and Aaron dig into Laravel’s `Stringable` class and uncover how it can silently skip Blade’s automatic HTML escaping. They explain why that’s both a convenient feature and a potential security pitfall if user input isn’t properly sanitized. You’ll hear practical ways to keep your views safe without losing the API’s fluency.
- (00:00) - Stringable can sidestep Blade escaping
- (03:45) - Dangers of outputting unsanitized HTML
- (05:45) - Defensive strategies for safe rendering
- (08:45) - Silly bit
Sign up for a short, but useful, Laravel tip each day in our newsletter
127 episodes
Manage episode 484483414 series 2974897
Joel and Aaron dig into Laravel’s `Stringable` class and uncover how it can silently skip Blade’s automatic HTML escaping. They explain why that’s both a convenient feature and a potential security pitfall if user input isn’t properly sanitized. You’ll hear practical ways to keep your views safe without losing the API’s fluency.
- (00:00) - Stringable can sidestep Blade escaping
- (03:45) - Dangers of outputting unsanitized HTML
- (05:45) - Defensive strategies for safe rendering
- (08:45) - Silly bit
Sign up for a short, but useful, Laravel tip each day in our newsletter
127 episodes
All episodes
×Welcome to Player FM!
Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.