Laravel如何保护自己免受html注入？

Question

Hello I'm new to laravel and I tried to add HTML to a <h6> field like below image .

and it appears in the page source like this

My question is why it doesn't render in the browser ? What has Laravel done here ?

My Blade code :

   @extends('layouts')

<div class="row">
    <div class='col-md-6 offset-md-3'   >
    @section('content')
    <h1>{{$card->title}}</h1>

    {{$card->created_at}}


    <br>
    <ul class="list-group">
    @foreach($card->notes as $note)

    <li class="list-group-item">
        <h6>{{$note->body}}</h6> <button class="btn btn-info btn-sm" onclick="togglediv('divform{{$note->id}}')" >Edit</button>

        <div class="col-md-6 offset-md-3" id="divform{{$note->id}}" style="display: none;">
    <hr>
<form action="/notes/{{$note->id}}/edit" method="POST">
  {{ csrf_field() }}
  {{ method_field('PATCH') }}
  <div class="form-group">
    <label for="exampleInputPassword1"><h6>Edit the note</h6></label>
    <input type="text-area" name="body" class="form-control" id="body" placeholder="{{$note->body}}">
  </div>


  <button type="submit" class="btn btn-success btn-sm">Done</button>
</form>
</div>


    </li>


    @endforeach


<script type="text/javascript">function togglediv(id) {
    var div = document.getElementById(id);
    div.style.display = div.style.display == "none" ? "block" : "none";
}</script>






    </ul>
</div>
</div>
@endsection

@section('footer')

<br>
<div class="col-md-6 offset-md-3">
    <hr>
<form action="/cards/{{$card->id}}/notes" method="POST">
  {{ csrf_field() }}
  <div class="form-group">
    <label for="exampleInputPassword1"><h3>Add a new note</h3></label>
    <input type="text-area" name="body" class="form-control" id="body" placeholder="Body">
  </div>


  <button type="submit" class="btn btn-primary">Add Note</button>
</form>
</div>
@endsection

Answer 1

Your html is escaped ,if you don't want that use the following syntax to output the html

  {!!$note->body!!}

more info