How does Blade protect against XSS, and what is the difference between {{ $data }} and {!! $data !!}?

Short answer

{{ $data }} automatically passes text through htmlspecialchars() to prevent malicious scripts from running, while {!! $data !!} outputs raw text without protection.

Explanation

Cross-Site Scripting attacks happen when an attacker injects JavaScript that runs in another user's browser. Blade protects the application by default by converting special characters such as < and > into safe text entities &lt; and &gt;. Use {!! !!} only for completely trusted, clean HTML that has been sanitized with a library such as HTMLPurifier.

Code example

{{ "<script>alert(1)</script>" }}
{{-- Rendered safely as text, not executed --}}

Common mistakes

• Using {!! !!} to display direct user input, such as comments or names, on the page.

Follow-up questions

• How do you implement a Content Security Policy with a Nonce in Laravel applications?

Sources

• Laravel docs — Blade Templates: Displaying Data