Weave Code
Sanitizer Laravel Package
elegantweb/sanitizer
Laravel package that cleans and normalizes user input before validation. Define sanitizer classes with rule sets to trim strings, cast types, strip tags, and transform request data, keeping controllers lean and application data consistent. Extensible with custom filters.
Sanitization library for PHP and Laravel framework.
Frequently asked questions about Sanitizer
- How do I install elegantweb/sanitizer in Laravel?
- Install it with Composer by running composer require elegantweb/sanitizer. The package is PSR-4 autoloaded and registers its service provider through Laravel package auto-discovery, so there is no manual wiring. You then define sanitizer classes with a filters array and call sanitize() from controllers, FormRequests, middleware, or console commands.
- Which Laravel and PHP versions does elegantweb/sanitizer support?
- It is best suited to Laravel 8 through 11 on PHP 8.0 through 8.3, but you should confirm the exact constraints in the composer.json of the release you install. The illuminate/validation version constraint is the most likely break point on a Laravel major upgrade, so pin it deliberately. The package shows active maintenance with a March 2026 release date.
- How is elegantweb/sanitizer different from Laravel's TrimStrings and ConvertEmptyStringsToNull middleware?
- Laravel's global middleware performs a fixed, framework-wide normalization pass, while this package lets you declare per-endpoint sanitizer classes with explicit filter sets. Running both creates two competing normalization passes, so pick a single canonical order, typically middleware first and Sanitizer second. Many teams leave TrimStrings enabled and use sanitizers for type casting, tag stripping, and domain-specific transforms.
- Can I use elegantweb/sanitizer outside Laravel in plain PHP?
- Yes. The package leans on illuminate/support and illuminate/validation rather than the full framework, so sanitizer classes can be instantiated standalone. That makes it usable in shared libraries, queue workers, CLI importers, and services that already pull illuminate components. You keep the same filter API, though the Laravel-specific ergonomics are reduced.
- How do I use a sanitizer with a Laravel FormRequest?
- Delegate from prepareForValidation() to a Sanitizer instance and leave your existing validation rules untouched. This isolates the behavior change to normalization only, which makes it easy to review and roll back. It also keeps your sanitizer classes unit-testable independently of the request lifecycle.
- Can I write custom filters for elegantweb/sanitizer?
- Yes, the library is extensible with custom filters, which is the intended path for domain normalization such as phone numbers to E.164 or slug generation. Before relying on them broadly, confirm with the maintainer whether custom filters are a stable first-class extension point or an escape hatch that can shift across minor releases. Register each custom filter and cover it with tests.
- Does elegantweb/sanitizer protect my app from XSS?
- No. Sanitization is defense-in-depth, not an XSS control, and you should not treat it as one. Output encoding in Blade and parameterized queries remain your primary defenses. Use this package to make input consistent, not to make stored user content safe.
- What happens when a sanitizer silently changes or drops data?
- This is a secondary risk worth planning for: sanitizers return cleaned data without surfacing what was stripped, which can mask upstream contract violations. Ask the maintainer about the failure contract, exceptions versus silent coercion, and whether it is configurable per filter. For high-value fields, log or assert on significant transformations in production.
- Is elegantweb/sanitizer safe to adopt in production given its small maintainer base?
- The technical risk is low, but supply chain risk is real: roughly 115 stars, a single maintainer, a bus factor of 1, and no vendor SLA. Mitigate by binding sanitizers behind interfaces and injecting them so you can swap implementations if the package is abandoned. Rollback is trivial, since you only need to remove the Composer line and delete the sanitizer classes.
- How should I migrate an existing Laravel app to elegantweb/sanitizer?
- Introduce it additively rather than retrofitting everything at once. Start with new endpoints and the highest-risk surfaces such as comments, profiles, support tickets, and free-text search. Then wrap existing FormRequests by delegating from prepareForValidation(), and finally consolidate scattered trim(), strip_tags(), and filter_var() calls into named sanitizer classes.
Weaver
How can I help you explore Laravel packages today?