xss with laravel 5.1 - laravel-5

Question

i am using laravel 5.1
i use this code to save posts to db
Auth::User()->posts()->save(Blog::create($request->all()));
and when i display post with this code some text and image i want to clean javascript and danger code !
<p>this is text</p>
<p> </p>
<p><img alt="" src="link" style="height:227px; width:342px" /></p>
<script>
alert("this is js");
</script>
{!! $post->content !!}
this is result
when i use
{{ $post->content }}
this is result
i want display images and prevent danger code any solutions

Answer 1

I don't know if it works on laravel 5.1 but on 5.0, you can use this :
<?php namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
class XSSProtection
{
/**
* The following method loops through all request input and strips out all tags from
* the request. This to ensure that users are unable to set ANY HTML within the form
* submissions, but also cleans up input.
*
* #param Request $request
* #param callable $next
* #return mixed
*/
public function handle(Request $request, \Closure $next)
{
if (!in_array(strtolower($request->method()), ['put', 'post'])) {
return $next($request);
}
$input = $request->all();
array_walk_recursive($input, function(&$input) {
$input = strip_tags($input);
});
$request->merge($input);
return $next($request);
}
}
And add it in Kernel.php
protected $middleware = [
'Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode',
'Illuminate\Cookie\Middleware\EncryptCookies',
'Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse',
'Illuminate\Session\Middleware\StartSession',
'Illuminate\View\Middleware\ShareErrorsFromSession',
'App\Http\Middleware\VerifyCsrfToken',
'App\Http\Middleware\XSSProtection',
];
Thanks to kirkbushell : http://laravel-tricks.com/tricks/laravel-5-xss-middleware

Answer 2

Try {{{ }}} this will escape user input and you can use this to sensitize before store it in database so check these functions HTML::entities(); or e()

Answer 3

You are doing a wrong thing by allowing html code to go to our database.
That being said, make sure to sanitize input (make use of e($data['example'])) when saving content and output - by using {{ }} or {{{ }}}
As for the images, create a table that contains ONLY image name. Handle the rest by using your controller (image location and stuff).
Good idea is to create subdirectory named as ID of post and then to store image there.
For example post ID 7 will have dir -> images/7/imagename from database.