php Laravel 转义刀片模板中的所有 HTML
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/26023823/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Laravel Escaping All HTML in Blade Template
提问by Dr.Neo
I'm building a small CMS in Laravel and I tried to show the content (which is stored in the DB). It is showing the HTML tags instead of executing them. Its like there is an auto html_entity_decode for all printed data.
我正在 Laravel 中构建一个小型 CMS，我试图显示内容（存储在数据库中）。它显示 HTML 标签而不是执行它们。它就像所有打印数据都有一个自动 html_entity_decode 。
<?php
class CmsController extends BaseController
{
public function Content($name)
{
$data = Pages::where('CID', '=', Config::get('company.CID'))
->where('page_name', '=', $name)
->first();
return View::make('cms.page')->with('content', $data);
}
}
I tried to print the content using the curly brace.
我尝试使用花括号打印内容。
{{ $content->page_desc }}
and triple curly brace.
和三重花括号。
{{{ $content->page_desc }}}
And they give the same result. I need to execute those HTML tags instead of escaping them.
他们给出了相同的结果。我需要执行这些 HTML 标签而不是转义它们。
回答by Ivan Topolcic
Change your syntax from {{ }}to {!! !!}.
将您的语法从 更改{{ }}为{!! !!}。
As The Alpha said in a comment above (not an answer so I thought I'd post), in Laravel 5, the {{ }}(previously non-escaped output syntax) has changed to {!! !!}. Replace {{ }}with {!! !!}and it should work.
正如 The Alpha 在上面的评论中所说（不是答案，所以我想我会发布），在 Laravel 5 中，{{ }}（以前的非转义输出语法）已更改为{!! !!}. 替换{{ }}为{!! !!}它应该可以工作。
回答by sanjay
use this tag {!! description text !!}
使用这个标签{!! 说明文字！！}
回答by Avinash Kumar
Include the content in {! !} .
将内容包含在 {! ！}。
回答by Mehmet Sefa Bal?k
I had the same issue. Thanks for the answers above, I solved my issue. If there are people facing the same problem, here is two way to solve it:
我遇到过同样的问题。感谢上面的回答，我解决了我的问题。如果有人面临同样的问题，这里有两种解决方法：
- You can use
{!! $news->body !!} - You can use traditional php openning (It is not recommended) like:
<?php echo $string ?>
- 您可以使用
{!! $news->body !!} - 您可以使用传统的 php 打开（不推荐），例如：
<?php echo $string ?>
I hope it helps.
我希望它有帮助。
回答by Marcin Nabia?ek
There is no problem with displaying HTML code in blade templates.
在刀片模板中显示 HTML 代码没有问题。
For test, you can add to routes.php only one route:
为了测试，你可以只添加到 routes.php 一个路由：
Route::get('/', function () {
$data = new stdClass();
$data->page_desc
= '<strong>aaa</strong><em>bbb</em>
<p>New paragaph</p><script>alert("Hello");</script>';
return View::make('hello')->with('content', $data);
}
);
and in hello.blade.phpfile:
并在hello.blade.php文件中：
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8">
</head>
<body>
{{ $content->page_desc }}
</body>
</html>
For the following code you will get output as on image
对于以下代码，您将获得图像上的输出
So probably page_descin your case is not what you expect. But as you see it can be potential dangerous if someone uses for example '` tag so you should probably in your route before assigning to blade template filter some tags
所以可能page_desc在你的情况下不是你所期望的。但是正如您所见，如果有人使用例如 '` 标签，则可能存在潜在危险，因此您可能应该在分配给刀片模板之前在您的路线中过滤一些标签
EDIT
编辑
I've also tested it with putting the same code into database:
我还通过将相同的代码放入数据库对其进行了测试：
Route::get('/', function () {
$data = User::where('id','=',1)->first();
return View::make('hello')->with('content', $data);
}
);
Output is exactly the same in this case
在这种情况下输出完全相同
Edit2
编辑2
I also don't know if Pagesis your model or it's a vendor model. For example it can have accessor inside:
我也不知道Pages是你的型号还是供应商的型号。例如，它可以在里面有访问器：
public function getPageDescAttribute($value)
{
return htmlspecialchars($value);
}
and then when you get page_descattribute you will get modified page_descwith htmlspecialchars. So if you are sure that data in database is with raw html (not escaped) you should look at this Pagesclass
然后当您获得page_desc属性时，您将page_desc使用htmlspecialchars. 所以，如果你确信在数据库中的数据是原始的HTML（没有逃脱），你应该看看这个Pages类
回答by emi
{{html_entity_decode ($post->content())}} saved the issue for me with Laravel 4.0. Now My HTML content is interpreted as it should.
{{html_entity_decode ($post->content())}} 使用 Laravel 4.0 为我解决了这个问题。现在我的 HTML 内容被解释为它应该的。
