> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Eloquent Casting to HtmlString!
- URL: https://securinglaravel.com/security-tip-eloquent-casting-to-htmlstring/
- Published: 2025-06-10T19:00:07.000Z
- Updated: 2025-06-10T19:00:06.000Z
- Description: [Tip #114] One of my favourite Laravel features, the humble HtmlString, is now available as an Eloquent Cast - which should make it much more accessible! 🎉 But there is a catch... 😟
- Author: Stephen Rees-Carter
- Tags: Security Tips, XSS, Blade

Long-time readers will be [well aware](https://securinglaravel.com/security-tip-avoiding-xss-with-htmlstring/) how much I love the `HtmlString` helper class in Laravel. It's an important way to prevent [Cross-Site Scripting (XSS)](https://securinglaravel.com/tag/xss/) from sneaking into your apps.

💡

For those unfamiliar with the class, the `HtmlString` class (`\Illuminate\Support\HtmlString`) provides a way for you to identify a string as HTML and prevent Blade's escaped tags (`{{ ... }}`) from escaping the string - keeping your Blade free of potentially dangerous `{!! ... !!}` tags. [Learn more here...](https://securinglaravel.com/security-tip-avoiding-xss-with-htmlstring/)

The only downside of `HtmlString` is that you need to manually wrap your content, however, thanks to a [Pull Request](https://github.com/laravel/framework/pull/55071?ref=securinglaravel.com) from [Ralph J. Smit](https://github.com/ralphjsmit?ref=securinglaravel.com), you can now automatically cast attributes as `HtmlString`:

```php
protected function casts(): array
{
   return [
      'html' => AsHtmlString::class,
   ];
}
```

And then use them directly inside your Blade templates:

```blade
<div>
  {{ $model->html }}
</div>
```

This is [available in Laravel v12.4](https://laravel-news.com/eloquent-cast-for-html-strings-in-laravel?ref=securinglaravel.com), and looks like it will save a bit of boilerplate when working with HTML strings.

 **⚠️ But wait a sec...**

I would be remiss if I didn't point out the **massive security risk** with using this cast! This cast means whatever is stored in the database will be rendered without being escaped - typically rendered as HTML. If the user has any control over this content, they could easily inject some XSS and hijack your app. 

That said, this is the *same* risk as using `HtmlString` manually - but using the cast **potentially hides** the fact that the string is being rendered as HTML. This could result in developers not being aware the attributes they are sending user-data into aren't going to be escaped.

So if you're going to use this cast, make sure you properly name and document it - so you and your team aren't going to accidently open up some XSS. Which, to be fair, is what you need to do any time you're using `HtmlString`. 

**In other words... be intentional when using tools with sharp edges like `HtmlString`, especially around user data.**

---

Securing Laravel is SPONSORED by... 

**Want to see your brand here?*

[Find out more... ](https://securinglaravel.com/sponsor/) 

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*