How to convert string to HTML codes in php laravel?

Question

I have a field in the database which store script tags and I want to implement those script tags into my HTML file but the problem is that data is coming string format

I am trying this

<div class="mb-auto">{{htmlentities($video->ifram)}}</div>

Desired output

<script id="154896_p_269505" width="1280" height="720" src=""  class="dacast-video"></script>

But getting

"&lt;script id=&quot;154896_p_269505&quot; width=&quot;1280&quot; height=&quot;720&quot; src=&quot;https://player.dacast.com/js/player.js?contentId=154896_p_269505&quot; class=&quot;dacast-video&quot;&gt;&lt;/script&gt;"

Not sure if there is automatic escaping done, but removing htmlentities() may be a start. — Nigel Ren
– Nigel Ren, Commented Apr 4, 2020 at 12:00
@NigelRen By removing htmlentities() the result is coming in a string format. — Mohit Chandel
– Mohit Chandel, Commented Apr 4, 2020 at 12:02

Shizzen83 · Accepted Answer · 2020-04-04 12:01:49Z

2

You can achieve this by replacing

<div class="mb-auto">{{htmlentities($video->ifram)}}</div>

with

<div class="mb-auto">{!! $video->ifram !!}</div>

But you should be very careful about XSS attack since the JavaScript present in your string will be interpreted by the browser. NEVER do it with a user-provided content!

answered Apr 4, 2020 at 12:01

Shizzen83

3,5593 gold badges14 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Mohit Chandel Over a year ago

Is there any safer way, so I can escape XSS attack

Shizzen83 Over a year ago

Since you allow arbitrary JavaScript to be interpreted, there is a XSS vulnerability. If you really need to do this, be sure the content cannot be updated except by yourself

Collectives™ on Stack Overflow

How to convert string to HTML codes in php laravel?

1 Answer 1

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Related