From 8034e2fc66de1b5e1c78cbda40d741f5ceb1d5b5 Mon Sep 17 00:00:00 2001
From: Alex Hawke <alex@shq.org.uk>
Date: Tue, 19 Aug 2025 18:53:23 +0100
Subject: [PATCH] [3.x] fix(forms): escape placeholder attributes so quotes
 render correctly

Escape placeholder values when rendering placeholder attributes so double quotes do not break the attribute or render as backslashes. Apply HTML escaping at output time while preserving nulls. Components: text-input, textarea, color-picker, date-time-picker (native).

Refs #17170.
---
 .../forms/resources/views/components/color-picker.blade.php     | 2 +-
 .../forms/resources/views/components/date-time-picker.blade.php | 2 +-
 packages/forms/resources/views/components/text-input.blade.php  | 2 +-
 packages/forms/resources/views/components/textarea.blade.php    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/forms/resources/views/components/color-picker.blade.php b/packages/forms/resources/views/components/color-picker.blade.php
index 020863066c..174f349b94 100644
--- a/packages/forms/resources/views/components/color-picker.blade.php
+++ b/packages/forms/resources/views/components/color-picker.blade.php
@@ -71,7 +71,7 @@
                             'id' => $getId(),
                             'inlinePrefix' => $isPrefixInline && (count($prefixActions) || $prefixIcon || filled($prefixLabel)),
                             'inlineSuffix' => $isSuffixInline && (count($suffixActions) || $suffixIcon || filled($suffixLabel)),
-                            'placeholder' => $getPlaceholder(),
+                            'placeholder' => ($getPlaceholder() === null) ? null : e((string) $getPlaceholder()),
                             'required' => $isRequired() && (! $isConcealed()),
                             'type' => 'text',
                             'x-model' . ($isLiveDebounced ? '.debounce.' . $liveDebounce : null) => 'state',
diff --git a/packages/forms/resources/views/components/date-time-picker.blade.php b/packages/forms/resources/views/components/date-time-picker.blade.php
index b94e468665..8c33dec24f 100644
--- a/packages/forms/resources/views/components/date-time-picker.blade.php
+++ b/packages/forms/resources/views/components/date-time-picker.blade.php
@@ -55,7 +55,7 @@
                             'list' => $datalistOptions ? $id . '-list' : null,
                             'max' => $hasTime ? $maxDate : ($maxDate ? \Carbon\Carbon::parse($maxDate)->toDateString() : null),
                             'min' => $hasTime ? $minDate : ($minDate ? \Carbon\Carbon::parse($minDate)->toDateString() : null),
-                            'placeholder' => $getPlaceholder(),
+                            'placeholder' => ($getPlaceholder() === null) ? null : e((string) $getPlaceholder()),
                             'readonly' => $isReadOnly(),
                             'required' => $isRequired() && (! $isConcealed()),
                             'step' => $getStep(),
diff --git a/packages/forms/resources/views/components/text-input.blade.php b/packages/forms/resources/views/components/text-input.blade.php
index d838677b33..3b92af7174 100644
--- a/packages/forms/resources/views/components/text-input.blade.php
+++ b/packages/forms/resources/views/components/text-input.blade.php
@@ -88,7 +88,7 @@
                         'maxlength' => (! $isConcealed) ? $getMaxLength() : null,
                         'min' => (! $isConcealed) ? $getMinValue() : null,
                         'minlength' => (! $isConcealed) ? $getMinLength() : null,
-                        'placeholder' => $getPlaceholder(),
+                        'placeholder' => ($getPlaceholder() === null) ? null : e((string) $getPlaceholder()),
                         'readonly' => $isReadOnly(),
                         'required' => $isRequired() && (! $isConcealed),
                         'step' => $getStep(),
diff --git a/packages/forms/resources/views/components/textarea.blade.php b/packages/forms/resources/views/components/textarea.blade.php
index bbdf465e04..83a852ef0c 100644
--- a/packages/forms/resources/views/components/textarea.blade.php
+++ b/packages/forms/resources/views/components/textarea.blade.php
@@ -67,7 +67,7 @@
                             'id' => $getId(),
                             'maxlength' => (! $isConcealed) ? $getMaxLength() : null,
                             'minlength' => (! $isConcealed) ? $getMinLength() : null,
-                            'placeholder' => $getPlaceholder(),
+                            'placeholder' => ($getPlaceholder() === null) ? null : e((string) $getPlaceholder()),
                             'readonly' => $isReadOnly(),
                             'required' => $isRequired() && (! $isConcealed),
                             'rows' => $rows,