Escaping

Propel escapes output by default. Every {{ }} value is escaped before it reaches the browser, and that is what protects a page against cross-site scripting.

Text is escaped

The characters &, <, >, " and ' are written as HTML entities.

<p>{{ $comment }}</p>

Live example

Raw output

The raw-output tag prints a value without escaping. Use it only for trusted HTML, such as markup you wrote yourself.

<div>{!! $html !!}</div>

Live example

trusted

Links and other URLs

An echoed value in an href, src, action, formaction or xlink:href attribute must use a safe scheme: http, https, mailto or tel, or a relative path. Any other value becomes #. This applies to raw output too.

<a href="{{ $url }}">Profile</a>

Live example

Safe link, shown as text: https://example.com/?a=1&b=2

Unsafe link, its href becomes #

Scheme hidden by a tab, still #

Writing the syntax as text

To show Propel's own syntax on a page, double the @ and the braces. @@ prints @, @{{ prints {{, and @{!! prints {!!.

Write @@if (x) and @{{ $name }}.

Live example

Write @if (x) and {{ $name }}.