Markdown Preview

Laravel renders Markdown with Str::markdown(). It uses the league/commonmark package with GitHub Flavored Markdown, so tables, task lists, strikethrough and autolinks work like they do in this preview.

Raw HTML in the Markdown is allowed by default. GitHub Flavored Markdown escapes a few tags such as <script>, but an <img onerror> attribute and a javascript: link pass through. For text your users write, strip both:

use Illuminate\Support\Str;

$html = Str::markdown($comment->body, [
    'html_input' => 'strip',
    'allow_unsafe_links' => false,
]);

// In the Blade view: {!! $html !!}

Laravel also writes emails in Markdown. php artisan make:mail OrderShipped --markdown=mail.orders.shipped creates a mailable with a Markdown template that uses Laravel's mail components.