# Understanding XSS and Preventing It in Laravel

> Author: [Oussama Ghaieb](https://oussama.ghaieb.com/about-me)
> Canonical: https://oussama.ghaieb.com/posts/understanding-xss-and-preventing-it-in-laravel

# <span class="hover:bg-yellow-100">Understanding XSS and Preventing It in Laravel</span>

Cross-Site Scripting (XSS) is one of the most common vulnerabilities in web applications. It occurs when an attacker injects malicious scripts into webpages viewed by other users. These scripts can steal sensitive data, hijack user sessions, or perform unauthorized actions.

In this blog post, we’ll explore how XSS works and demonstrate how to prevent it in Laravel applications.

---

## What is XSS?

XSS attacks are categorized into three types:

1. **Stored XSS**: Malicious scripts are permanently stored on the server (e.g., in a database) and served to users whenever they access a particular page.
2. **Reflected XSS**: Malicious scripts are included in the URL or HTTP request and executed when the server includes them in the response without proper validation.
3. **DOM-based XSS**: The attack occurs directly in the browser due to insecure JavaScript code manipulating the DOM.

---

## How XSS Works

Here’s a basic example of an XSS attack:

1. A user submits a comment containing malicious JavaScript code, such as:
   ```html
   <script>alert('Hacked!');</script>
   ```
2. The application stores this comment in its database without sanitization.
3. When another user views the comments, the malicious script executes in their browser.

---

## Preventing XSS in Laravel

Laravel provides robust tools to prevent XSS attacks by default. Here are some best practices:

### 1. Escape Output with Blade

Blade, Laravel’s templating engine, escapes output automatically using the `e()` function. For example:

```php
<p>{{ $userInput }}</p>
```
This ensures that any HTML or JavaScript in `$userInput` is escaped and not executed.

If you need to render raw HTML, use the `{!! !!}` syntax, but be cautious and only use it for trusted content:

```php
<p>{!! $trustedHtml !!}</p>
```

### 2. Sanitize User Input

Use libraries like `HTMLPurifier` to clean user input before storing it:

```php
use HTMLPurifier;

$purifier = new HTMLPurifier();
$cleanInput = $purifier->purify($userInput);
```

### 3. Validate Input

Laravel’s validation rules can help ensure that user input is safe. For instance, if you’re expecting a URL, validate it:

```php
$request->validate([
    'website' => 'url',
]);
```

### 4. Use the `escape` Helper for JSON Responses

When returning JSON responses, use Laravel’s `response()->json()` method or the `JsonResource` class, which escapes data appropriately.

### 5. Avoid Inline Event Handlers

Avoid using inline event handlers like `onclick="someJsFunction()"` directly in your HTML. Instead, attach event listeners in your JavaScript files.

### 6. Content Security Policy (CSP)

A Content Security Policy can prevent the execution of unauthorized scripts. Configure it using Laravel middleware or headers:

```php
header("Content-Security-Policy: script-src 'self'");
```

---

## Example: Comment System in Laravel

Here’s how to safely implement a comment system in Laravel:

### 1. Store Comments Safely

Use validation and sanitization when saving user input:

```php
public function store(Request $request)
{
    $request->validate([
        'comment' => 'required|string|max:1000',
    ]);

    $purifier = new \HTMLPurifier();
    $cleanComment = $purifier->purify($request->comment);

    Comment::create(['body' => $cleanComment]);

    return redirect()->back()->with('success', 'Comment posted!');
}
```

### 2. Display Comments Safely

Escape all user-generated content in your views:

```php
@foreach($comments as $comment)
    <p>{{ $comment->body }}</p>
@endforeach
```

This ensures that any potentially malicious scripts are displayed as plain text rather than executed.

<!-- ---

## Testing Your Application

Use tools like [OWASP ZAP](https://owasp.org/www-project-zap/) or [Burp Suite](https://portswigger.net/burp) to scan your application for XSS vulnerabilities. -->

---

## Conclusion

Preventing XSS is essential for maintaining the security of your Laravel application. By leveraging Laravel’s built-in features and following best practices, you can protect your users from this common attack vector.