Avoid unescaped Laravel Blade output from request or model data

#Metadata

Rule ID

php.security.laravel-unsafe-blade-output

Severity

high

Confidence

0.84

Languages

php

Presets

security, strict

Stability

stable

Applies to

block

Tags

laravel, php, rules-catalog, security, xss

#Why it matters

Unescaped template output can enable stored or reflected XSS when user-controlled values are rendered as HTML.

#Remediation

Prefer escaped Blade output (`{{ }}`) and sanitizer wrappers before rendering user-influenced HTML.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/php/php.security.laravel-unsafe-blade-output.rule.yaml.