Sheath rule
blade-valid-echo-expression
Echo contents must be a parseable PHP expression without the echo terminator embedded in it.
#Why
Blade treats the first }} as the end of a {{ }} echo, even when it appears
inside a PHP string literal:
{{ "literal }} inside" }}
compiles to
<?php echo e("literal); ?> inside" }}
The string is cut mid-literal, the compiled view is invalid PHP, and the rest
of the expression appears on the page as text. {!! !!} truncates the same way
at !!}, and {{{ }}} at }}}.
Empty echoes are the same class of defect: {{ }} compiles into mangled PHP
rather than being skipped. Blade also wraps whatever the echo contains in
echo e(...) unchanged, so content that is not a PHP expression, such as two
statements or an embedded semicolon, compiles into a view that dies at first
render.
#Examples
#Bad
<p>{{ "literal }} inside" }}</p>
<p>{!! "x!!} y" !!}</p>
<p>{{ }}</p>
<div class="{{ }}">Styled</div>
<p>{{ $first; $second }}</p>
#Good
<p>{{ $user->name }}</p>
<p>{{ $user->isAdmin() ? 'Admin' : 'Member' }}</p>
<p>{{ $name ?? 'Guest' }}</p>
<p>{{ $name; }}</p>
<p>{!! $trustedHtml !!}</p>
{{-- Only !!} ends a raw echo, so }} inside one is fine --}}
<p>{!! $a . "}}" !!}</p>
{{-- Multiline echoes are supported --}}
{{ $user
->name }}
{{-- Escaped echoes and verbatim blocks belong to the frontend --}}
<p>@{{ vueExpression }}</p>
@verbatim
<p>{{ alsoVue }}</p>
@endverbatim
#Notes
- Echoes inside attribute values are checked too:
class="{{ }}"miscompiles exactly like an echo in text position. - To emit a literal
}}, build it without writing the sequence:{{ '}'.'}' }}, or move the text to a variable. - Dynamic or unusual expressions are accepted when they are valid PHP.
- Laravel intentionally removes one final semicolon from an echo expression,
so
{{ $value; }}and the equivalent raw/triple forms are valid.
#Related Rules
- blade-no-triple-echo - legacy
{{{ }}}syntax - security-no-raw-echo - raw output that could cause XSS