why the html code sent by controller displays in my page?

Question

I work by ecommerce site, and I want to test the quantity of product (annonce), if the qty = 0 display Not Avialable in danger color, if qty <= 5 display low Stock in color if qty > 5 display in Stock in success color. in my example it displays in my html code page.

AnnoncesController.php

public function show($id)
    {
        $annonces = Annonce::where('id',$id)->firstOrfail();
        $mightAlsoLike = Annonce::where('id', '!=', $id)->mightAlsoLike()->get();

        if( $annonces->quantity > setting('site.stock_threshold') ){
            $stockLevel = '<div class="badge badge-pill badge-success">in stock</div>';
        } elseif($annonces->quantity <= setting('site.stock_threshold') && $annonces->quantity > 0) {
            $stockLevel = '<div class="badge badge-pill badge-warning">low stock</div>';
        }else {
            $stockLevel = '<div class="badge badge-pill badge-danger">Not Avialable</div>';
        }

         return view('annonces.details')->with([
             'annonces'      => $annonces,
             'stockLevel'    => $stockLevel, 
             'mightAlsoLike' => $mightAlsoLike
            ]);
    }

details.blade.php

<div>{{ $stockLevel }}</div>

Surely because the value of $stockLevel is automatically converted to HTML entities. — José Carlos PHP, Nov 02 '21 at 13:37

ManojKiran A · Accepted Answer · 2021-11-02T14:03:42.817

If you want to display the complied html you can use the below syntax and docs can be found Here

<div>{!! $stockLevel !!}</div>

Or You can use HtmlString class

<div>{{new Illuminate\Support\HtmlString($stockLevel )}}</div>

and be careful with XSS vulnerability

Or you can pass data from Controller

public function show($id)
    {
        $stockLevelStatus = $stockLevelBadge = null;
        $annonces = Annonce::where('id', $id)->firstOrfail();
        $mightAlsoLike = Annonce::where('id', '!=', $id)->mightAlsoLike()->get();

        if ($annonces->quantity > setting('site.stock_threshold')) {
            $stockLevelStatus = 'In Stock';
            $stockLevelBadge = 'badge-success';
        } elseif ($annonces->quantity <= setting('site.stock_threshold') && $annonces->quantity > 0) {
            $stockLevelStatus = 'Low Stock';
            $stockLevelBadge = 'badge-warning';
        } else {
            $stockLevelStatus = 'Not Avialable';
            $stockLevelBadge = 'badge-danger';
        }

        return view('annonces.details')->with([
            'annonces' => $annonces,
            'stockLevelStatus'  => $stockLevelStatus,
            'stockLevelBadge' => $stockLevelBadge,
            'mightAlsoLike' => $mightAlsoLike,
        ]);
    }

balde:

<div>
  <div class="badge badge-pill {{$stockLevelBadge}}"> 
   {{$stockLevelStatus}}
  </div>
</div>

score 1 · Answer 2 · answered Nov 02 '21 at 13:37

1

{!! $stockLevel !!}

try this. it is worked forme

answered Nov 02 '21 at 13:37

Hasan Çetin

172
1
9

If you answer a question, don't just say "try this", but explain your answer. – Gert B. Nov 02 '21 at 13:55
Cause when you send html {{ !! !!}} use this if you use {{ $stockLevel }} it read a text. – Hasan Çetin Nov 02 '21 at 14:07
No, Because `{{ }}`escapes the html , and `{!! !!}` is a raw echo. Using `{!! !!}` is not recommended on user input because you are open to XSS attacks. – Gert B. Nov 02 '21 at 14:12

score 1 · Answer 3 · answered Nov 02 '21 at 13:45

If you do not want your data to be escaped, you may use the following syntax:

{!! $stockLevel !!}

BUT I DO NOT RECOMMEND IT. By default, Blade {{ }} statements are automatically sent through PHP's htmlspecialchars function to prevent XSS attacks. Better to make conditional through Blade :

@if($annonces->quantity > setting('site.stock_threshold'))
    <div class="badge badge-pill badge-success">in stock</div>
@elseif($annonces->quantity <= setting('site.stock_threshold') && $annonces->quantity > 0)
    <div class="badge badge-pill badge-warning">low stock</div>
@else
    <div class="badge badge-pill badge-danger">Not Avialable</div>
@endif

why the html code sent by controller displays in my page?

3 Answers3