> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Safely Rendering JSON in Blade
- URL: https://securinglaravel.com/security-tip-safely-rendering-json/
- Published: 2023-03-30T13:01:13.000Z
- Updated: 2025-01-28T02:13:44.000Z
- Description: [Tip#41] It's quite common to inject JSON into Blade templates for various use cases, but is it actually safe to do so? Not really...
- Author: Stephen Rees-Carter
- Tags: Security Tips, XSS, Blade, Escaping

It’s a pretty common approach to pass data between your backend and frontend through Blade by rendering a block of JSON into a JS variable.

Something like this:

```
<script>
    var options = <?php echo json_encode($options); ?>;
</script>
```

However, is this safe?

Well, it depends... [In earlier versions of PHP](https://stackoverflow.com/a/6817147?ref=securinglaravel.com), [it wasn’t safe](https://forums.phpfreaks.com/topic/294115-json%5Fencode-is-not-a-security-feature-or-how-to-pass-php-values-to-javascript/?ref=securinglaravel.com). Now… maybe?

The issue is that `json_encode()` isn’t designed for outputting a safe block of JSON within a script block inside HTML. It’s default encoding only handles a basic subset of special cases, and there is always the risk that a new bypass is discovered that will allow for breaking out of the JSON and injecting a custom script.

Some of my favourites from older versions of PHP include simply using a `</script>` tag or special `“quotes”` that PHP will ignore but Javascript will translate into standard quotes. *(I was disappointed I couldn't get a demo working of these!)*

So what should you do instead?

Laravel provides a helper class, `Illuminate\Support\Js` ([source](https://github.com/laravel/framework/blob/10.x/src/Illuminate/Support/Js.php?ref=securinglaravel.com)), which includes the extra encoding flags you want when using `` `json_encode()` `` within HTML.

Using it is trivial:

```
<script>
    var options = {{ Js::from($options) }};
</script>
```

It’s super simple to use - in fact it’s even shorter than the previous code - and will ensure no one can sneak anything into your JSON.

To wrap up, let’s review the difference in output - which nicely shows the benefits in using the helper.

```
<script>
// json_encode();
var options = {"elves":"three","dwarves":"seven","men":"nine","dark lord":"one"};

// Js::from()
var options = JSON.parse('{\u0022elves\u0022:\u0022three\u0022,\u0022dwarves\u0022:\u0022seven\u0022,\u0022men\u0022:\u0022nine\u0022,\u0022dark lord\u0022:\u0022\\u003C\\\/script\\u003E\u0022}');
</script>
```

## Update: 2023-05-24

A [recent addition to Laravel](https://github.com/laravel/framework/pull/46935?ref=securinglaravel.com) added a new `Js::encode()` helper, which you can use to encode JSON without the addition of `JSON.parse(...)` that `Js::from()` adds.

```
> Js::encode(['elves' => 'three', 'dwarves' => 'seven']);
= "{"elves":"three","dwarves":"seven"}"
```

These two helper functions should remove the need to use `@js()` and `@json()` entirely.

*Don’t forget, you can put these safely inside* `{{ ... }}` *tags too!*

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*