All rules

Sheath rule

blade-no-php-echo

A @php block whose only job is to echo should be written as a Blade echo.
Package
Core
Category
Blade
Default severity
warning by default
Auto-fix
Auto-fix available

. See Auto-fix.

Part of the migration preset.

#Why

@php echo $body; @endphp and {!! $body !!} both produce unescaped output. Using Blade echo syntax makes that escaping choice explicit and allows security-no-raw-echo to inspect it.

#Examples

#Bad

@php echo $post->body; @endphp



@php

    echo $heading;

@endphp

#Good

{{-- Escaped, which is what most values want --}}

{{ $heading }}



{{-- Raw, stated out loud --}}

{!! $post->body !!}

#Auto-fix

--fix rewrites the block to {!! !!}, which produces the same bytes as the @php echo it replaces. It does not rewrite to {{ }}: that would silently add escaping, and changing what a page renders is not a formatting fix.

{{-- before --}}

@php echo $post->body; @endphp



{{-- after --}}

{!! $post->body !!}

The expression is carried over exactly as written, spacing included.

If the value should be escaped, change the delimiters yourself once the fix has made the raw echo visible. Most values should be escaped.

#When it reports but will not rewrite

These block shapes require a manual rewrite because one Blade echo cannot preserve their behavior.

Block Why
More than one statement The rest of the block has nowhere to go
echo $a, $b; Two writes; one Blade echo cannot stand in for them
Anything holding a comment The comment would be dropped
An echoed heredoc A heredoc body cannot live inside echo delimiters
An expression containing !!} It would close the echo early

An @endphp inside a string can end the block before the intended terminator. For example, @php echo "@endphp"; @endphp is not offered an automatic rewrite.

#Notes

  • Only echo is matched. print is an expression that evaluates to 1, so it is not the same rewrite.
  • The inline @php($total = 0) form assigns rather than echoes and is never reported.

#Related Rules