【唐诗】《天末憶李白》 杜甫：涼風起天末，君子意如何。鴻雁幾時到，江湖秋水多。文章憎命達，魑魅喜人過。應共冤魂語，投詩贈汩羅。

永夜

没有不值得去解决的问题，也没有不值得去学习的技术！

Invalid JSON Syntax Error When Parsing: Auto-Escaping With addcslashes()

在网页端的表现为，在请求参数中输入：\ 时，响应 200，进而导致在渲染模板时响应 500

作者：

永夜

在

, , , , , ,
Views: 50

1. On the web frontend, when entering \ in the request parameters, the response is 200, which then causes a 500 response when rendering the template. See Figure 1.

On the web frontend, when entering \ in the request parameters, the response is 200, which then causes a 500 response when rendering the template
Figure 1

2. Checked the corresponding logs in Alibaba Cloud Log Service (SLS), and found the error: Invalid json Syntax error when parsing the JSON format. See Figure 2.

Checked the corresponding logs in Alibaba Cloud Log Service (SLS), and found the error: Invalid json Syntax error when parsing the JSON format
Figure 2
Plaintext

detail:Invalid json: {
  "sections": {
    "3collection_s7mzoitr": {
      "type": "main-collections",
      "settings": {
        "heading": "\GráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트"
      },
      "blocks": {
        "collection-0": {
          "type": "collection",
          "settings": {
            "id": 119
          }
        }
      }
    }
  }
}
: Syntax error (View: /var/www/object/resources/views/theme/pages/index.blade.php) {"exception":"[object] (Illuminate\\View\\ViewException(code: 0): Invalid json: {
  \"sections\": {

              \"3collection_s7mzoitr\": {
          \"type\": \"main-collections\",
          \"settings\": {
            \"heading\": \"\\GráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트\"
          },
  }
}
: Syntax error (View: /var/www/object/resources/views/theme/pages/index.blade.php) at /var/www/object/Modules/ThemeSetting/Util/JsonDecoder.php:18)
[stacktrace]
#0 /./vendor/laravel/framework/src/Illuminate/View/Engines/PhpEngine.php(45): Illuminate\\View\\Engines\\CompilerEngine->handleViewException(Object(RuntimeException), 0)
#1 /./vendor/laravel/framework/src/Illuminate/View/Engines/CompilerEngine.php(59): Illuminate\\View\\Engines\\PhpEngine->evaluatePath('/var/www/object/...', Array)
#2 /./vendor/laravel/framework/src/Illuminate/View/View.php(143): Illuminate\\View\\Engines\\CompilerEngine->get('/var/www/object/...', Array)
#3 /./vendor/laravel/framework/src/Illuminate/View/View.php(126): Illuminate\\View\\View->getContents()
#4 /./vendor/laravel/framework/src/Illuminate/View/View.php(91): Illuminate\\View\\View->renderContents()
#5 /./vendor/laravel/framework/src/Illuminate/Http/Response.php(42): Illuminate\\View\\View->render()
#6 /./vendor/symfony/http-foundation/Response.php(205): Illuminate\\Http\\Response->setContent(Object(Illuminate\\View\\View))
#7 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(749): Symfony\\Component\\HttpFoundation\\Response->__construct(Object(Illuminate\\View\\View), 200, Array)
#8 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(721): Illuminate\\Routing\\Router::toResponse(Object(Illuminate\\Http\\Request), Object(Illuminate\\View\\View))
#9 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(681): Illuminate\\Routing\\Router->prepareResponse(Object(Illuminate\\Http\\Request), Object(Illuminate\\View\\View))
#10 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\\Routing\\Router->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))
#11 /./vendor/silber/page-cache/src/Middleware/CacheResponse.php(38): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#12 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Silber\\PageCache\\Middleware\\CacheResponse->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#13 /var/www/object/app/Http/Middleware/FacebookSwitch.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#14 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\FacebookSwitch->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#15 /var/www/object/app/Http/Middleware/CheckStoreStatus.php(37): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#16 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\CheckStoreStatus->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#17 /var/www/object/app/Http/Middleware/Statistics.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#18 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\Statistics->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#19 /var/www/object/app/Http/Middleware/PasswordProtected.php(66): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#20 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\PasswordProtected->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#21 /var/www/object/app/Http/Middleware/DetectLanguage.php(25): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#22 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\DetectLanguage->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#23 /var/www/object/app/Http/Middleware/ConfigTheme.php(101): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#24 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\ConfigTheme->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#25 /./vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php(41): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#26 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Routing\\Middleware\\SubstituteBindings->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#27 /var/www/object/app/Http/Middleware/SwitchDomain.php(34): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#28 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\SwitchDomain->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#29 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#30 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#31 /./vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#32 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#33 /./vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(56): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#34 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Session\\Middleware\\StartSession->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#35 /./vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#36 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#37 /./vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#38 /var/www/object/app/Http/Middleware/EncryptCookies.php(29): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#39 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\EncryptCookies->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#40 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#41 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(683): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#42 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(658): Illuminate\\Routing\\Router->runRouteWithinStack(Object(Illuminate\\Routing\\Route), Object(Illuminate\\Http\\Request))
#43 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(624): Illuminate\\Routing\\Router->runRoute(Object(Illuminate\\Http\\Request), Object(Illuminate\\Routing\\Route))
#44 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(613): Illuminate\\Routing\\Router->dispatchToRoute(Object(Illuminate\\Http\\Request))
#45 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(170): Illuminate\\Routing\\Router->dispatch(Object(Illuminate\\Http\\Request))
#46 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}(Object(Illuminate\\Http\\Request))
#47 /./vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php(60): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#48 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Barryvdh\\Debugbar\\Middleware\\InjectDebugbar->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#49 /var/www/object/app/Http/Middleware/ChangeAppUrlMiddleware.php(23): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#50 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\ChangeAppUrlMiddleware->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#51 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#52 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#53 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#54 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#55 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#56 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#57 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(63): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#58 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\CheckForMaintenanceMode->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#59 /./vendor/fideloper/proxy/src/TrustProxies.php(57): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#60 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Fideloper\\Proxy\\TrustProxies->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#61 /./vendor/dingo/api/src/Http/Middleware/Request.php(111): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#62 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Dingo\\Api\\Http\\Middleware\\Request->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#63 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#64 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(145): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#65 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(110): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter(Object(Illuminate\\Http\\Request))
#66 /var/www/object/public/index.php(57): Illuminate\\Foundation\\Http\\Kernel->handle(Object(Illuminate\\Http\\Request))
#67 {main}

[previous exception] [object] (RuntimeException(code: 0): Invalid json: {
  \"sections\": {


              \"3collection_s7mzoitr\": {
          \"type\": \"main-collections\",
          \"settings\": {
            \"heading\": \"\\GráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트\"
          },

        },

  }
}
: Syntax error at /var/www/object/Modules/ThemeSetting/Util/JsonDecoder.php:18)
[stacktrace]
#0 /var/www/object/Modules/ThemeSetting/View/ManagesTemplate.php(43): Modules\\ThemeSetting\\Util\\JsonDecoder::jsonToArray('{\
  \"sections\":...')
#1 /./vendor/laravel/framework/src/Illuminate/Support/Traits/Macroable.php(114): Illuminate\\View\\Factory->Modules\\ThemeSetting\\View\\{closure}()
#2 /var/www/object/storage/framework/views/8770ac3ae62f52f71ff8e3e1b63e49e7e9ce5ac3.php(222): Illuminate\\View\\Factory->__call('renderObjectSect...', Array)
#3 /./vendor/laravel/framework/src/Illuminate/View/Engines/PhpEngine.php(43): include('/var/www/object/...')
#4 /./vendor/laravel/framework/src/Illuminate/View/Engines/CompilerEngine.php(59): Illuminate\\View\\Engines\\PhpEngine->evaluatePath('/var/www/object/...', Array)
#5 /./vendor/laravel/framework/src/Illuminate/View/View.php(143): Illuminate\\View\\Engines\\CompilerEngine->get('/var/www/object/...', Array)
#6 /./vendor/laravel/framework/src/Illuminate/View/View.php(126): Illuminate\\View\\View->getContents()
#7 /./vendor/laravel/framework/src/Illuminate/View/View.php(91): Illuminate\\View\\View->renderContents()
#8 /./vendor/laravel/framework/src/Illuminate/Http/Response.php(42): Illuminate\\View\\View->render()
#9 /./vendor/symfony/http-foundation/Response.php(205): Illuminate\\Http\\Response->setContent(Object(Illuminate\\View\\View))
#10 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(749): Symfony\\Component\\HttpFoundation\\Response->__construct(Object(Illuminate\\View\\View), 200, Array)
#11 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(721): Illuminate\\Routing\\Router::toResponse(Object(Illuminate\\Http\\Request), Object(Illuminate\\View\\View))
#12 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(681): Illuminate\\Routing\\Router->prepareResponse(Object(Illuminate\\Http\\Request), Object(Illuminate\\View\\View))
#13 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\\Routing\\Router->Illuminate\\Routing\\{closure}(Object(Illuminate\\Http\\Request))
#14 /./vendor/silber/page-cache/src/Middleware/CacheResponse.php(38): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#15 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Silber\\PageCache\\Middleware\\CacheResponse->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#16 /var/www/object/app/Http/Middleware/FacebookSwitch.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#17 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\FacebookSwitch->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#18 /var/www/object/app/Http/Middleware/CheckStoreStatus.php(37): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#19 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\CheckStoreStatus->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#20 /var/www/object/app/Http/Middleware/Statistics.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#21 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\Statistics->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#22 /var/www/object/app/Http/Middleware/PasswordProtected.php(66): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#23 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\PasswordProtected->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#24 /var/www/object/app/Http/Middleware/DetectLanguage.php(25): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#25 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\DetectLanguage->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#26 /var/www/object/app/Http/Middleware/ConfigTheme.php(101): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#27 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\ConfigTheme->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#28 /./vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php(41): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#29 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Routing\\Middleware\\SubstituteBindings->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#30 /var/www/object/app/Http/Middleware/SwitchDomain.php(34): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#31 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\SwitchDomain->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#32 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#33 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#34 /./vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#35 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#36 /./vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(56): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#37 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Session\\Middleware\\StartSession->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#38 /./vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#39 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#40 /./vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#41 /var/www/object/app/Http/Middleware/EncryptCookies.php(29): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#42 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\EncryptCookies->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#43 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#44 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(683): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#45 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(658): Illuminate\\Routing\\Router->runRouteWithinStack(Object(Illuminate\\Routing\\Route), Object(Illuminate\\Http\\Request))
#46 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(624): Illuminate\\Routing\\Router->runRoute(Object(Illuminate\\Http\\Request), Object(Illuminate\\Routing\\Route))
#47 /./vendor/laravel/framework/src/Illuminate/Routing/Router.php(613): Illuminate\\Routing\\Router->dispatchToRoute(Object(Illuminate\\Http\\Request))
#48 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(170): Illuminate\\Routing\\Router->dispatch(Object(Illuminate\\Http\\Request))
#49 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(130): Illuminate\\Foundation\\Http\\Kernel->Illuminate\\Foundation\\Http\\{closure}(Object(Illuminate\\Http\\Request))
#50 /./vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php(60): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#51 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Barryvdh\\Debugbar\\Middleware\\InjectDebugbar->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#52 /var/www/object/app/Http/Middleware/ChangeAppUrlMiddleware.php(23): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#53 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): App\\Http\\Middleware\\ChangeAppUrlMiddleware->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#54 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#55 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#56 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#57 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#58 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#59 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#60 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/CheckForMaintenanceMode.php(63): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#61 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Illuminate\\Foundation\\Http\\Middleware\\CheckForMaintenanceMode->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#62 /./vendor/fideloper/proxy/src/TrustProxies.php(57): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#63 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Fideloper\\Proxy\\TrustProxies->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#64 /./vendor/dingo/api/src/Http/Middleware/Request.php(111): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#65 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(171): Dingo\\Api\\Http\\Middleware\\Request->handle(Object(Illuminate\\Http\\Request), Object(Closure))
#66 /./vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(105): Illuminate\\Pipeline\\Pipeline->Illuminate\\Pipeline\\{closure}(Object(Illuminate\\Http\\Request))
#67 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(145): Illuminate\\Pipeline\\Pipeline->then(Object(Closure))
#68 /./vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(110): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter(Object(Illuminate\\Http\\Request))
#69 /var/www/object/public/index.php(57): Illuminate\\Foundation\\Http\\Kernel->handle(Object(Illuminate\\Http\\Request))
#70 {main}
"}

3. Initially suspected it was related to \. After removing the input \ from the request parameters, the template rendering responded with 200. See Figure 3.

Initially suspected it was related to \. After removing the input \ from the request parameters, the template rendering responded with 200
Figure 3

4. Decided to print the JSON string to be parsed in the test environment. Found that although the input was \, the request parameter had already changed to \\, and when parsing, it was already \, which caused the parsing error. See Figure 4.

Decided to print the JSON string to be parsed in the test environment. Found that although the input was \, the request parameter had already changed to \\, and when parsing, it was already \, which caused the parsing error.
Figure 4
JSON

{
  "sections": {
    "3collection_s7mzoitr": {
      "type": "main-collections",
      "settings": {
        "heading": "\GráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트Top CategoriesTamañoTableauTaillesGrößentabelleGráサイズチャートТаблица РазмеровMaattabel사이즈 차트TamañoGrößentabelleGráa toサТаблица 차트"
      },
      "blocks": {
        "collection-0": {
          "type": "collection",
          "settings": {
            "id": 119
          }
        }
      }
    }
  }
}

5. The \\ should still be preserved before calling the JSON parsing. However, the current business logic is that after receiving the JSON, it is first stored in the cache (at this point it has already changed to \), and then the JSON is retrieved from the cache and placed into the template file, where the JSON parsing is then executed. Viewing the template file that reported the error. See Figure 5.

The \\ should still be preserved before calling the JSON parsing. However, the current business logic is that after receiving the JSON, it is first stored in the cache (at this point it has already changed to \), and then the JSON is retrieved from the cache and placed into the template file, where the JSON parsing is then executed. Viewing the template file that reported the error
Figure 5
PHP
<?php if($section['type'] === 'collection'): ?>
        "<?php echo e($id); ?>": {
          "type": "main-collections",
          "settings": {
            "heading": "<?php echo e($section['title']); ?>"
          },
          "blocks": {
            <?php $__currentLoopData = $section['ids']; $__env->addLoop($__currentLoopData); foreach($__currentLoopData as $key => $item): $__env->incrementLoopIndices(); $loop = $__env->getLastLoop(); ?>
              "collection-<?php echo e($key); ?>": {
                "type": "collection",
                "settings": {
                  "id": <?php echo e($item); ?>
 
                }
              }<?php if(!$loop->last): ?>,<?php endif; ?>
            <?php endforeach; $__env->popLoop(); $loop = $__env->getLastLoop(); ?>
          }
        },
      <?php endif; ?>

6. Edited the original template file to automatically escape based on the string function addslashes(). Rendering the template no longer reported an error. This matched expectations. See Figure 6.

Edited the original template file to automatically escape based on the string function addslashes(). Rendering the template no longer reported an error. This matched expectations
Figure 6
PHP

      @if($section['type'] === 'collection')
        "{{ $id }}": {
          "type": "main-collections",
          "settings": {
            "heading": "{{ addslashes($section['title']) }}"
          },
          "blocks": {
            @foreach ($section['ids'] as $key => $item)
              "collection-{{ $key }}": {
                "type": "collection",
                "settings": {
                  "id": {{ $item }}
                }
              }@if (!$loop->last),@endif
            @endforeach
          }
        },
      @endif

7. However, when entering the ‘ and “” characters, the response was 500. Parsing failed. See Figure 7.

However, when entering the ' and "" characters, the response was 500. Parsing failed
Figure 7

8. Viewed the rendered PHP template code, e(addslashes($section[‘title’]))

PHP
      <?php if($section['type'] === 'collection'): ?>
        "<?php echo e($id); ?>": {
          "type": "main-collections",
          "settings": {
            "heading": "<?php echo e(addslashes($section['title'])); ?>"
          },
          "blocks": {
            <?php $__currentLoopData = $section['ids']; $__env->addLoop($__currentLoopData); foreach($__currentLoopData as $key => $item): $__env->incrementLoopIndices(); $loop = $__env->getLastLoop(); ?>
              "collection-<?php echo e($key); ?>": {
                "type": "collection",
                "settings": {
                  "id": <?php echo e($item); ?>
 
                }
              }<?php if(!$loop->last): ?>,<?php endif; ?>
            <?php endforeach; $__env->popLoop(); $loop = $__env->getLastLoop(); ?>
          }
        },
      <?php endif; ?>

9. The expected \’ was converted to: \&quot;

10. Decided to modify the Blade template source code, using {!! !!} to prevent the issue in step 9.

PHP

{!! addslashes($section['title']) !!}

11. When entering the ‘ character, although the format had already changed to: \’, the response was 500. Parsing failed. See Figure 8.

When entering the ' character, although the format had already changed to: \', the response was 500. Parsing failed
Figure 8

12. Finally decided to only escape \, based on addcslashes — Quote string with slashes in a C style

PHP

{!! addcslashes($section['title'], '\\') !!}

13. Request parameter: ‘, ‘ parsed successfully. See Figure 9.

Request parameter: ', ' parsed successfully
Figure 9

14. When entering the ” character, request parameter: \”, ” failed to parse. See Figure 10.

When entering the " character, request parameter: \", " failed to parse
Figure 10

15. At this point, the JSON escaping should be consistent with the frontend, escaping \ and “

PHP

{!! addcslashes($section['title'], '\\"') !!}

16. When entering the ” character, request parameter: \”, \” parsed successfully. See Figure 11.

When entering the " character, request parameter: \", \" parsed successfully
Figure 11

17. Tested the input of js code; the js script was not executed, because the JSON format is only used for parsing, and when rendering the template, it still passes through PHP’s htmlspecialchars function to prevent XSS attacks. See Figure 12.

Tested the input of js code; the js script was not executed, because the JSON format is only used for parsing, and when rendering the template, it still passes through PHP's htmlspecialchars function to prevent XSS attacks
Figure 12
JavaScript


alert("Hello! I am an alert box!");

18. The following characters are reserved characters that cannot be used directly in JSON and must be properly escaped to be used in strings. Any character except ” or \ or control characters. Reference URL: https://www.json.org/json-zh.html . If receiving data input from the frontend in rich text, all the following characters need to be escaped. See Figure 13.

The following characters are reserved characters that cannot be used directly in JSON and must be properly escaped to be used in strings. Any character except " or \ or control characters. Reference URL: https://www.json.org/json-zh.html . If receiving data input from the frontend in rich text, all the following characters need to be escaped
Figure 13
Plaintext

Backspace to be replaced with \b

Form feed to be replaced with \f

Newline to be replaced with \n

Carriage return to be replaced with \r

Tab to be replaced with \t

quotation mark \"

Backslash to be replaced with \\

19. When entering a newline character, request parameter: \n, \n failed to parse. See Figure 14.

When entering a newline character, request parameter: \n, \n failed to parse
Figure 14
JSON

{
                  "heading": "\\\"'


IMAGE WITH TEXT1"
                }
PHP

{!! addcslashes($section['horizontal']['title'], '\n\\"') !!}

20. Adjusted the charlist parameter of addcslashes, enclosing it with “”. Parsed successfully. See Figure 15.

Adjusted the charlist parameter of addcslashes, enclosing it with "". Parsed successfully
Figure 15
JSON
{!! addcslashes($section['horizontal']['title'], '\n\\"') !!}

20. You usually do not need to worry about escaping characters yourself when generating JSON programmatically (of course, you will when manually editing JSON-based configuration files, for example). Instead, use whatever native mapping, array, string, number, boolean, and null types your language has to form the data structure you want to encode, and then use a JSON encoding function to encode it into JSON. Such a function is likely built into whatever language you are using, such as JavaScript’s JSON.stringify or PHP’s json_encode. Now it is confirmed that the JSON-based configuration file was being manually edited in the template file.

21. However, \b will replace the b in the value

Plaintext
abfnrt
中国人人要
uc"\/4 
HTML;

echo "$title\n\n\n";

$json = '{"title": "' . addcslashes($title, "\b\f\n\r\t\\\"") . '"}';

// echo $json;

$obj = json_decode($json);

// var_dump($obj);

echo $obj->{'title'};

?>
Plaintext
abfnrt
中国人人要
uc"\/4 


afnrt
中国人人要
uc"\/4

22. However, \u will cause parsing to fail

Plaintext
abfnrt
中国人人要
uc"\/4 
HTML;

echo "$title\n\n\n";

$json = '{"title": "' . addcslashes($title, "\b\f\n\r\t\u\\\"") . '"}';

// echo $json;

$obj = json_decode($json);

// var_dump($obj);

echo $obj->{'title'};

?>
Plaintext
abfnrt
中国人人要
uc"\/4 



Notice:  Trying to get property 'title' of non-object in E:\wwwroot\addcslashes.php on line 19

23. The final demo example, the output matches expectations. See Figure 16.

The final demo example, the output matches expectations
Figure 16
Plaintext
abfnrt
中国人人要
uc"\/4 
HTML;

echo "$title\n\n\n";

$json = '{"title": "' . addcslashes($title, "\f\n\r\t\\\"") . '"}';

// echo $json;

$obj = json_decode($json);

// var_dump($obj);

echo $obj->{'title'};

?>
Plaintext
abfnrt
中国人人要
uc"\/4 


abfnrt
中国人人要
uc"\/4

关于作者 · 持续学习与技术实践

我是一名拥有 15 年以上开发经验的技术从业者，自 2013 年起持续运营个人技术博客，记录工作与个人项目中遇到的真实问题，以及解决问题过程中的探索、实践和思考。

除了技术写作，我也在持续开发和维护自己的独立项目，探索新技术和新工具在实际场景中的应用。我始终相信，没有不值得去解决的问题，也没有不值得去学习的技术。

如果这篇文章对你有所帮助，欢迎浏览博客中的其他文章，也欢迎交流技术经验与想法。

关于我  ·  GitHub  ·  邮件联系

更多文章