这是在laravel中构建模板/布局系统的好方法吗？ 将数据保存到数据库会更好吗？

Question

I'm building a Laravel PHP application where a user will be able to create 'layouts' for pages.

To make a layout a user enters HTML in a form and optionally they may specify areas where, when creating a page that uses this layout, a WYSIWYG editor would allow an editor to add content.

What happens now is this HTML is saved in /storage/templates/layouts as a .blade.php file. The user designates the editable areas by using blade's @yield directive. Each editable area is wrapped with an @section directive and concatenated into a single .blade.php file and the @extends() directive is added, referencing the layout. Then it's saved in /storage/templates/pages. When a page is requested, it simply returns the view as a normal blade view return view('templates.pages.{page_slug}');.

In terms of performance, security and maintainability is this a good approach? Would storing this data in a database be better? Any suggestions for improving?

Answer 1

I think this is not good for security purposes. If I understand correctly, the user can enter blade code? Or html code which is stored in blade files? If so, they can execute PHP code on your server. For example, if I would write in my html file:

@php(\App\User::first()->some_data)

I could get all user data, delete all files and can basically control everything. I would probably store only the HTML in normal files or in the database and load them with: {!! $userPage->htmlCode !!} or something. So they can enter html code but not PHP / Blade code.

If you have any questions, feel free to comment!