Preventing XSS and SQL Injection

Cross-Site Scripting (XSS) and SQL injection are two of the most common web vulnerabilities. Laravel's tools help prevent both by default, as long as a few conventions are followed.

Preventing XSS

Blade's {{ }} syntax automatically escapes output, converting special characters so injected HTML or scripts can't execute in the browser.

{{ $comment->body }}   {{-- safely escaped --}}
{!! $comment->body !!} {{-- NOT escaped — avoid with user input --}}

The unescaped {!! !!} syntax should only ever be used with content you fully trust, never raw user input.

Preventing SQL Injection

Eloquent and the query builder use parameter binding, meaning user input is never concatenated directly into SQL strings.

// Safe — parameter binding
User::where('email', $request->email)->first();

// Dangerous — raw concatenation
DB::select("SELECT * FROM users WHERE email = '" . $request->email . "'");

Staying Safe

• Always use Eloquent or the query builder instead of raw string concatenation
• Escape output by default; only bypass escaping for trusted, sanitized HTML
• Validate and sanitize all incoming request data

These protections stop malicious input from doing damage, but attackers can also just try to guess credentials repeatedly — which is where rate limiting comes back in.