Sheath rule
blade-no-triple-echo
Reports
{{{ }}} and rewrites it as {{ }}.
#Why
Blade compiles both forms to the same thing:
{{{ $name }}} compiles to <?php echo e($name); ?>
{{ $name }} compiles to <?php echo e($name); ?>
The triple-brace form still works and still escapes. It is no longer in Laravel's
documentation, so a template using it suggests a distinction from {{ }} that
does not exist. Use the documented form.
#Examples
#Bad
{{{ $user->name }}}
{{{ $message }}}
{{{ $html }}}
#Good
<!-- Escaped output -->
{{ $user->name }}
{{ $message }}
<!-- Raw output, where it is genuinely wanted -->
{!! $trustedHtml !!}
#Auto-fix
Auto-fix converts triple braces to double braces:
<!-- Before -->
{{{ $user->name }}}
<!-- After -->
{{ $user->name }}
#Notes
- Output is unchanged by the fix, since both forms compile to the same escaped echo.
- The expression is carried over as written.
- When the expression itself contains
}}, the violation is still reported but no fix is offered. That sequence is not a triple-echo terminator, but it would prematurely terminate the replacement's regular echo.
#Related Rules
- security-no-raw-echo - Avoid raw output that could cause XSS