- How do I install bgaze/bootstrap-form in a Laravel application?
- Install it with Composer using composer require bgaze/bootstrap-form, then use the BF facade or the package's x-bf::* Blade components directly in your templates. Because it is a Blade form builder, no build step or JavaScript bundle is required beyond the Bootstrap CSS your app already loads. Check the repository README for any optional config publishing or asset setup steps before wiring it into existing views.
- Which Laravel and PHP versions does bgaze/bootstrap-form support?
- The package targets Laravel 12 and later, and it is actively maintained with recent releases such as v4.2.0. The changelog for that release does not spell out an explicit PHP version range, so confirm the exact constraint in the package's composer.json on Packagist before upgrading. Match that constraint against your application matrix, especially if you run multiple Laravel versions across services.
- How do I build a Bootstrap form with model binding, validation errors, and old input?
- The package exposes a fluent PHP API through the BF facade and matching Blade components, so you declare fields rather than hand-writing markup. It handles model binding, validation error display, old input repopulation, labels, help text, and layout classes for you. That removes the repetitive Bootstrap HTML that normally has to be repeated for every input, select, and checkbox. The result is consistent, accessible markup that follows Bootstrap conventions.
- Does bgaze/bootstrap-form support both Bootstrap 4 and Bootstrap 5?
- Yes, the package renders forms for Bootstrap 4 and Bootstrap 5. Note that in the v4.2.x line the Bootstrap 4 output is effectively frozen, so newer features such as the escape setting are really Bootstrap 5-era functionality in practice. If you are still on Bootstrap 4, expect stable output rather than new rendering options.
- What does the escape setting added in bgaze/bootstrap-form v4.2.0 actually do?
- It escapes string values at the content sinks that previously always emitted raw HTML, such as labels, help text, success messages, and prepend or append addons. The setting follows the package's existing config, then form, then field cascade and defaults to false, so existing rendering stays byte-identical unless you opt in. It is a sink-level rendering option, not a replacement for escaping data at your application boundaries.
- Does enabling escape => true make my Laravel forms XSS-safe?
- No, and the release notes are explicit about that. The setting only affects how values that are already strings are rendered at the package's sinks. Escaping user input, database values, and translation strings at the boundary remains your application's responsibility. The main risk is a team enabling the flag globally and assuming XSS is handled, so document the limitation before rollout.
- Why do my labels and addons show literal HTML tags after enabling escape?
- Any label, help text, or addon that relied on raw markup strings will render as visible tags once escape => true is applied, because strings are now escaped at the sink. Component slots and values passed as Htmlable or HtmlString are the intended opt-out and still render as markup. Audit call sites that concatenate HTML into strings and convert them to Htmlable or Blade components before enabling the flag at config level. Per-field rollout is possible but becomes unmanageable at scale, so prefer a planned config-level switch.
- What changed for boolean attributes like escape="false" in v4.2.0?
- Attributes such as escape, switch, inline, custom, show-all-errors, show-valid-feedback, and disable-errors now read only the literal strings true and false. Previously escape="false" was treated as truthy and silently enabled escaping, so those call sites now get the behavior they actually wrote. String-valued settings like help="false" are unaffected. Grep your Blade views and components for these attributes and confirm test coverage before upgrading.
- Is anything excluded from the escape setting, like BF::label() or validation messages?
- Yes, several areas sit outside the setting by design, including required_mark, validation messages, and standalone BF::label() calls. BF::label() has its own per-call argument and will not honor a global escape setting, which is a consistency trap worth documenting for your team. Treat these as known gaps and escape their content yourself where required.
- How do I test the bgaze/bootstrap-form v4.2.0 upgrade without visual regressions?
- Upgrading is low friction: a Composer update is enough, and nothing changes unless you opt into escape => true. The real work is an audit of which sinks currently receive user input, database values, or translation strings, plus a check for call sites relying on the old addon heuristic that escaped values like temperatures but passed tags through raw. Plain-text addons containing pre-encoded entities now render once-decoded, so snapshot and visual regression tests will diff. Run those suites before and after the change to catch both escaping shifts and hydration differences if you use Livewire or Alpine around these components.