Challenge 2 — Solution

Task: Write a Blade template fragment that loops over an array of
$products (each with 'name' and 'price' keys) and displays them in a
list, using Blade's @foreach/@endforeach and {{ }} syntax. Explain in a
comment exactly what security protection {{ }} provides automatically
that this course's plain-PHP views always had to apply manually.

---- resources/views/products/index.blade.php ----

<ul>
@foreach ($products as $product)
    <li>{{ $product['name'] }} - £{{ $product['price'] }}</li>
@endforeach
</ul>

{{-- What {{ }} provides automatically:
     Blade's {{ }} syntax calls htmlspecialchars() on the value
     automatically before outputting it - exactly the same escaping
     this course's own plain-PHP views (e.g. post_list.php in Chapter 3)
     always had to apply manually, via
     <?= htmlspecialchars($post['title']) ?>, on every single echoed
     value. Using {{ $product['name'] }} instead of a raw
     <?= $product['name'] ?> means an XSS attempt (e.g. a product name
     containing a <script> tag) is safely escaped and displayed as
     literal text rather than executed as real HTML/JavaScript in the
     visitor's browser - without the template author needing to
     remember to wrap every single value in htmlspecialchars()
     themselves, the way Intermediate Chapter 8's rule required by hand. --}}


Notes:
- @foreach/@endforeach is Blade's own directive syntax, compiled down
  to a real PHP foreach loop behind the scenes - functionally identical
  to the plain <?php foreach (...): ?> ... <?php endforeach; ?> syntax
  used throughout this course's own views, just with a shorter,
  cleaner syntax.
- {{ $product['price'] }} is used directly without any manual
  formatting here, matching the task's own scope - a real production
  template would likely use number_format() or a dedicated currency
  helper for the price, but that's a separate concern from the
  escaping behavior this challenge specifically asked about.
- Blade does provide an escape hatch, {!! $variable !!}, for the rare
  case where genuinely trusted, pre-sanitized HTML needs to be output
  unescaped - but {{ }} is the correct, safe default for ordinary data
  exactly like this product list.