Advanced Features

Security Features#

The Laravel Form package includes several built-in security features to protect your application:

1. CSRF Protection (Automatic)#

All forms automatically include CSRF token protection when using POST, PUT, PATCH, or DELETE methods:

{{ Form::open(['route' => 'users.store']) }}
    {{-- CSRF token is automatically added --}}
    {{ Form::text('name') }}
{{ Form::close() }}

// Manual CSRF token (if needed)
{{ Form::token() }}

2. XSS Prevention via Entity Encoding#

Form values and HTML output are automatically encoded to prevent XSS attacks:

// User input containing <script> tags will be safely encoded
{{ Form::text('name', $userInput) }}  // Automatically escaped

// The $escape parameter controls encoding behavior
{{ Html::link('url', '<b>Bold</b>', [], null, false) }}  // Renders bold text
{{ Html::link('url', '<b>Bold</b>', [], null, true) }}   // Shows literal <b> tags (safer)

3. Email Obfuscation (Anti-Spam)#

Email addresses in mailto links are automatically obfuscated to prevent spam bot harvesting:

// Automatically obfuscated using random entity encoding
{{ Html::mailto('contact@example.com') }}
// Output: <a href="&#109;&#x61;&#x69;&#108;&#116;&#x6f;&#58;&#99;...">

// Obfuscate email without creating a link
{{ Html::email('admin@example.com') }}
// Output: &#97;&#100;&#x6d;&#x69;&#110;&#64;...

// Obfuscate any text
{{ Html::obfuscate('Sensitive information') }}

4. Method Spoofing (REST Support)#

Forms handle HTTP method spoofing securely for PUT, PATCH, and DELETE requests:

{{ Form::open(['route' => ['users.destroy', $user->id], 'method' => 'DELETE']) }}
    {{-- Generates: <form method="POST"> --}}
    {{-- Plus hidden field: <input type="hidden" name="_method" value="DELETE"> --}}
    {{ Form::submit('Delete User') }}
{{ Form::close() }}

5. Secure HTTPS Links#

Generate secure HTTPS links easily:

// Force HTTPS on any link
{{ Html::secureLink('admin/dashboard', 'Admin Panel') }}

// Secure asset links
{{ Html::linkSecureAsset('documents/contract.pdf', 'Download Contract') }}

Best Practices:

• Always validate and sanitize user input server-side (these tools help with output, not input validation)
• Use the $escape parameter wisely - default to true unless you trust the content
• Never disable CSRF protection in production
• Use HTTPS in production environments
• Be cautious when using false for the $escape parameter

Request Consideration#

Enable request consideration to automatically fill form values from the current request:

{{ Form::open(['route' => 'users.store']) }}
    {{ Form::considerRequest() }}
    {{ Form::text('name') }} {{-- Will be filled from request if available --}}
    {{ Form::email('email') }}
    {{ Form::submit('Create User') }}
{{ Form::close() }}

Old Input Handling#

The form builder automatically handles old input from failed validation:

{{ Form::text('name', null, ['class' => 'form-control']) }}
{{ Form::email('email', null, ['class' => 'form-control']) }}

// If validation fails, the fields will be automatically filled with old input

Method Spoofing#

The form builder automatically handles method spoofing for PUT, PATCH, and DELETE requests:

{{ Form::open(['route' => ['users.update', $user->id], 'method' => 'PUT']) }}
    {{ Form::text('name') }}
    {{ Form::submit('Update') }}
{{ Form::close() }}

// This will create a form with method="POST" and add a hidden _method field with value "PUT"

File Uploads#

{{ Form::open(['route' => 'users.store', 'files' => true]) }}
    {{ Form::file('avatar', ['accept' => 'image/*']) }}
    {{ Form::file('documents[]', ['multiple' => true, 'accept' => '.pdf,.doc,.docx']) }}
    {{ Form::submit('Upload') }}
{{ Form::close() }}