Challenge 3: Demonstrate Escaping — Possible Solution
====================================================================

// app/Http/Controllers/DemoController.php

public function escapingDemo()
{
    $dangerousValue = '<script>alert("xss")</script>';
    return view('escaping-demo', ['value' => $dangerousValue]);
}

<!-- resources/views/escaping-demo.blade.php -->

<h2>Escaped (default):</h2>
<p>{{ $value }}</p>

<h2>Unescaped ({!! !!}):</h2>
<p>{!! $value !!}</p>

WHAT EACH VERSION ACTUALLY SENDS TO THE BROWSER
--------------------------------------------------
{{ $value }} — the escaped version — sends this literal HTML source:

    <p>&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;</p>

The browser displays this as plain, inert TEXT on the page:

    <script>alert("xss")</script>

It reads like a script tag, but it is NOT one — Blade converted the angle
brackets and quotes into HTML entities before sending the response, so
the browser's HTML parser never recognizes it as a real <script> element.
Nothing executes. This is functionally identical to what Django's default
{{ value }} produces, using the exact same underlying idea (escape
HTML-significant characters on output).

{!! $value !!} — the unescaped version — sends this literal HTML source:

    <p><script>alert("xss")</script></p>

The browser's HTML parser sees a genuine <script> tag here and executes
its contents immediately — the alert() popup actually fires. If
$dangerousValue had come from user input (a comment, a review, a search
query) instead of a hardcoded string, this is a textbook stored or
reflected XSS vulnerability — precisely the scenario the XSS course
covered, and precisely the scenario Django's |safe filter carries the
same risk for.

WHY THIS WORKS
--------------
- {{ }} is Blade's DEFAULT output syntax, and it always escapes — no
  configuration or extra step is needed to get this protection; a
  developer has to deliberately reach for {!! !!} to lose it.
- {!! !!} doesn't mean "this value is safe" — it means "output this
  exactly as given, with no escaping at all" — the same "trust me, don't
  check this" semantics as Django's |safe filter, just spelled
  differently.
- Compiled down to actual PHP, {{ $value }} becomes something like
  <?php echo htmlspecialchars($value, ENT_QUOTES, 'UTF-8'); ?> —
  htmlspecialchars() is PHP's standard escaping function, doing the exact
  character-substitution work described above.