How to restrict HTML/Javascript insertion in database table Laravel 5.2 - mysql

I could successfully save html/javascript into the database table and it renders it. This is for the first time I have moved to Laravel, YII frameworks automatically caters it but how can I do the same thing in Laravel?
I don't want to use specific checks all over my application, there must be some centralized approach to do so.
Output:
htmlentities($inputs['first_name']); that does the job but how to do this in the whole app. I don't want to have these checks everywhere.
That's how I render form:
{!! Form::model($companyUser, ['route' => ['updateUserProfile', $companyUser->id], 'method' => 'put', 'class' => 'frm-container']) !!}
<div class="col-lg-5">
{!! Form::controlRequired('text', 0, 'first_name', $errors, 'First Name') !!}
</div>
<div class="col-lg-5">
{!! Form::control('text', 0, 'last_name', $errors, 'Last Name') !!}
</div>
<br clear="all"/>
<div class="col-lg-5">
{!! Form::control('password', 0, 'password', $errors, 'New Password') !!}
</div>
<div class="col-lg-5">
{!! Form::control('password', 0, 'password_confirmation', $errors, 'Confirm Password') !!}
</div>
<br clear="all"/>
<div class="col-lg-12 btn-frm-inner">
<button type="submit" class="btn btn-submit">Update</button>
Cancel
</div>
{!! Form::close() !!}

The code you posted is from the form.
You're not supposed to filter what's going in the database in my opinion. You should simply let anything come and then display it the way you want. So this is fine.
Now as for displaying the data :
{{ }} will escape automatically, while {!! !!} will NOT escape anything.
So when you display the data in your view, you should use the first option.

Related

How can I select all the options in a multi select form laravel?

Data is fetching from the database, I want to select all locations coming from the database by default
#php
$default_location = null;
if(count($business_locations) == 1){
$default_location = array_key_first($business_locations->toArray());
}
#endphp
<div class="col-sm-4">
<div class="form-group">
{!! Form::label('product_locations', __('business.business_locations') . ':') !!} #show_tooltip(__('lang_v1.product_location_help'))
{!! Form::select('product_locations[]', $business_locations, $default_location, ['class' => 'form-control select2', 'multiple', 'id' => 'product_locations']); !!}
</div>
</div>
You can select all using jquery.
$(document).ready(function(){
// all selected
$("#product_locations").prop('checked', true);
});

Adding Bootstrap tooltips into form label

I trying to make tooltips into laravelcollective
<div class="form-group col-sm-4">
{!! Form::label('exchange_id', 'Exchanges:') !!}
{!! Form::select('exchange_id', [''=>'Choose Options'] + $exchanges , null, ['class'=>'form-control', 'id'=>'exchange', 'name'=>'exchange_id', 'onchange' => 'all_function()'])!!}
</div>
In the above select box, {!! Form::label('exchange_id', 'Exchanges:') !!} I want to put Bootstrap tooltips like, Exchanges ? : with question mark.
How can I do this?
You can add attribute to label tag, data-toggle="tooltip" and title="Exchanges ?"
<div class="form-group col-sm-4">
{!! Form::label('exchange_id', 'Exchanges:', ['data-toggle' => 'tooltip', 'title' => 'Exchanges ?']) !!}
{!! Form::select('exchange_id', ['' => 'Choose Options'] + $exchanges, null, ['class' => 'form-control', 'id' => 'exchange', 'name' => 'exchange_id', 'onchange' => 'all_function()'])!!}
</div>
Need bootstrap plugin and use like it
$(function () {
$('[data-toggle="tooltip"]').tooltip()
})
Tooltips: http://getbootstrap.com/docs/4.1/components/tooltips/
Demo: http://jsfiddle.net/xL1vteoj/

Form is not showing the btn bootstrap class in Laravel Blade

I imported "laravelcollective/html":"^5.4.0" and my form is working fine but I have this issue with the btn bootstrap class, it is not showing at all, but labels, text and textarea are.
{!!
...
{{ Form::submit('Create Post', null, array('class' => 'btn btn-success btn-lg btn-block')) }}
...
!!}
I am using Laravel 5.4.
What am I doing wrong? Thanks.
Never mind. I had null as an argument. Working now!

Pulling records from MySQL Db using Laravel 5.1 Pagination

Someone please help me! How Do I render the records of a DB using pagination? When I tried using this code based on the tutorial I'm using I'm getting this error below. I'd thought the results is a method in Paginate class.
<div id="questions">
<h2>Unsolved Questions</h2>
#if(!$questions->results)
<p>No questions have been asked</p>
#else{
<ul>
#foreach($questions->results as $question)
<li>{!! e($question->question) !!}</li>
#endforeach
</ul>
{!! $questions->links !!}
}
#endif
</div>
from ur controller e.g
$question_model = Questions::where('answer_count','=','0')->orderby('created_at','desc')->paginate(5);
in ur front end for pagination
{!! $question_model->render() !!}
This is the resolve to the question I posted as a response comment to #ujwal dhakal. What I wanted is to append the username of the user that asks a question.
The first thing I did is to add the user collection to the index.blade.php view of the question, then iterate through it and pick the username that matches the username of the Auth user that posted the question.
#if(!count($questions) > 0)
<p>No questions have been asked</p>
#else
<ul>
#foreach($questions as $question)
<li>{!! e(str_limit($question->questions, 35)) !!} by
#if(count($users) > 0)
#foreach($users as $user)
#if($user->id === $question->userid)
{!! $user->username !!}
#endif
#endforeach
#endif
</li>
#endforeach
</ul>
{!! $questions->render() !!}
#endif

Blade, Use html inside variable being passed into partial view is not being rendered

I'm using a partial view to display page header, that view accepts two variables one is Icon the other is a title.
pageHeader.blade.php:
<div class="page-header">
<div class="row">
<!-- Page header, center on small screens -->
<h1 class="col-xs-12 col-sm-4 text-center text-left-sm"><i class="fa {{$icon}} page-header-icon"></i> {{$title}}</h1>
</div>
and I'm using it like so:
#include('zdashboard._partials.pageHeader',['icon'=>'fa-pencil','title'=>'<strong>Editing</strong>'.$center->translations()->whereLang('en')->first()->name])
Sometimes I like to make one word strong or italic like the example above but, blade engine won't render the HTML tags I'm typing as part of title variable (the output like the photo down).
So is there any idea how to solve this? Am I doing it!
wrong?
The output
By default in Laravel 5 {{ $title }} construction wil be escaped.
If you don't want the data to be escaped, you may use the following syntax:
{!! $title !!}
Read more about Blade control structures: http://laravel.com/docs/5.0/templates#other-blade-control-structures
view
#if(Session::has('success'))
<div class="alert alert-success">
{!! Session::get('success')!!}
</div>
#endif
Controller
public function store(Request $request)
{
$this->validate($request, [
'product_code' => 'required|unique:products',
'product_name' => 'required',
'description' => 'required',
'price' => 'required',
'brand_id' => 'required',
'category_id' => 'required',
]);
$product = Product::create([
'product_code' => $request->input('product_code'),
'product_name' => $request->input('product_name'),
'description' => $request->input('description'),
'price' => $request->input('price'),
'brand_id' => $request->input('brand_id'),
'category_id' => $request->input('category_id'),
]);
return redirect()->route('products.index')->with('success',
"The product <strong>".$product->product_name."</strong> has successfully been created.");
}