Blade is Laravel's lightweight templating engine that augments HTML with shortcuts for PHP control flow, output escaping, and template inheritance. The double-brace syntax {{ $var }} applies htmlspecialchars to escape output and prevent XSS, while {!! $var !!} renders raw HTML, used only when you trust the source. Control directives like @if, @foreach, @extends, @section, and @yield make layouts composable: child templates @extends a parent, fill @section blocks, and the parent yields them in named slots. Pass data with return view('profile', ['user' => $user]), ->with('user', $user), or the compact() helper. Share a variable with every view by calling View::share('key', $value) in a service provider's boot().
Components package reusable markup and logic. Generate a class component with php artisan make:component Alert, which creates both a class in app/View/Components/ and a Blade view in resources/views/components/; render it as <x-alert type="error" :message="$msg" />. Anonymous components skip the class entirely: drop a Blade file into resources/views/components/ and use it as <x-alert />. {{ $slot }} renders child content; named slots work with <x-slot:name>...</x-slot:name>. Push scripts or styles from children into a parent placeholder with @stack('scripts') and @push('scripts'), or use @prepend to add to the front. For conditional or ordered partials, use @includeWhen, @includeIf, @includeFirst, and @each('partials.item', \(items, 'item', 'partials.empty').
Extend Blade with custom directives and built-ins. Register Blade::directive('datetime', fn (\)exp) => "<?php echo ($exp)->format('Y-m-d'); ?>") in a service provider, or use Blade::if('admin', fn () => auth()->check() && auth()->user()->isAdmin()) for conditional shortcuts. Render markdown with @markdown(\(post->body) and embed JSON in a <script> tag with @json(\)data). For dynamic templates such as emails, call Blade::render('Hello, {{ $name }}', ['name' => 'A']). CSRF protection is built in: @csrf outputs the _token hidden input that Laravel's VerifyCsrfToken middleware validates on non-GET requests. For SPAs posting to the same Laravel app, configure Sanctum to read the XSRF-TOKEN cookie and send it as the X-XSRF-TOKEN header (Axios does this automatically when withCredentials is true).
Laravel's paginator integrates directly with Eloquent and renders links via {{ $items->links() }}. paginate() runs a COUNT(*) query so you can show "X of Y" UIs, while simplePaginate() only knows whether a next page exists, making it cheaper for huge tables. For datasets where inserts shift pages, use cursorPaginate(15), which encodes cursors instead of page numbers and is stable across new rows. Customize the rendered view globally with Paginator::defaultSimpleView(...) or per call with $items->links('partials.pager'), and rename the page query parameter via Paginator::currentPageResolver(fn () => request('p', 1)).