CODEWITHSUNDEEP
phplaravelescapingsanitization
Josh Mountain
Josh Mountain

Reputation: 1950

Escaping output but allowing <p> in Laravel

In my Laravel app I allow users to store some text from a text area. When outputting the text I would like to escape the text retrieved from the DB, but also convert any line breaks from the text into <p> tags. I have a function nl2p() that works well for this, but it gets escaped when I place it inside the triple brackets defeating the purpose: {{{ nl2p($bio) }}}

I tried doing something like this:

<?php $formatted_bio = {{{ $user->bio }}}; ?>
<h2>{{ nl2p($formatted_bio) }}</h2>

but data can't be echoed into a variable like that. Any creative solutions out there I may have overlooked?

Upvotes: 0

Views: 478

Answers (1)

lukasgeiter
lukasgeiter

Reputation: 153020

Try using the e() helper function Laravel provides. It is basically what Blade calls under the hood when you do the triple braces.
So you'd have:

<h2>{{ nl2p(e($user->bio)) }}</h2>

Upvotes: 1

Related Questions