- What is HTML Purifier used for in a Laravel application?
- HTML Purifier filters untrusted HTML from user input or third-party sources using whitelists and aggressive parsing. In Laravel, you can use it to sanitize rich text before storing or rendering it, reducing XSS risk while preserving allowed markup. It is especially useful for WYSIWYG editor content that includes CSS and a broad tag set.
- How do I install HTML Purifier in Laravel with Composer?
- Run composer require ezyang/htmlpurifier in your Laravel project. Because it is a dependency-free PHP library, no Laravel service provider registration is required. You can then instantiate HTMLPurifier or HTMLPurifier_Config directly in controllers, services, form requests, or custom validation rules.
- Does HTML Purifier work with all Laravel versions?
- HTML Purifier is a pure PHP library and is not tied to a specific Laravel release. It works with Laravel versions that support the PHP version required by your installed HTML Purifier release. Check the package's Composer constraints and your Laravel PHP version before upgrading.
- How do I configure HTML Purifier for Laravel?
- Create an HTMLPurifier_Config instance, set options such as HTML.Allowed, CSS.AllowedProperties, and Cache.DefinitionImpl, then pass it to HTMLPurifier. In Laravel, you can wrap this in a service class or bind a configured purifier instance in a service provider. For production, cache the parsed configuration definition to avoid rebuilding it on every request.
- Can HTML Purifier sanitize WYSIWYG editor output like TinyMCE?
- Yes. HTML Purifier is designed for richly formatted documents from untrusted sources and supports CSS and a full tag set, making it suitable for TinyMCE, CKEditor, and similar WYSIWYG output. You configure allowed tags and CSS properties to match your editor's toolbar and content policy. The README points to WYSIWYG guidance for editor-specific notes.
- Is HTML Purifier safe for production XSS protection?
- HTML Purifier is built specifically to thwart XSS attacks through robust whitelists and aggressive parsing, and it also aims for standards-compliant output. It is widely used for sanitizing untrusted HTML, but you should still keep the package updated and configure a restrictive allowlist for your use case. Combine it with Laravel's output escaping and security headers rather than treating any single filter as complete protection.
- How does HTML Purifier perform in a Laravel app?
- HTML Purifier prioritizes correctness over raw speed, so filtering large or complex HTML can be slower than bare-bones parsers. In Laravel, enable configuration caching and consider storing sanitized HTML so you do not re-filter the same content on every request. Benchmark with realistic documents and cache aggressively where safe.
- Can I test HTML Purifier output in Laravel feature tests?
- Yes. You can write Laravel feature or unit tests that pass sample HTML through your configured purifier and assert the sanitized output. Test allowed tags, blocked attributes, CSS handling, and malformed markup that reflects your application's real input. Keeping the purifier in a dedicated service makes it easy to test in isolation.
- What are alternatives to HTML Purifier for Laravel HTML sanitization?
- Simpler options include strip_tags, Laravel's escaping helpers, or bare-bones HTML sanitizers, but they may not preserve rich formatting or enforce standards-compliant output. HTML Purifier is aimed at cases where you need CSS and a full tag set filtered correctly. Laravel-specific wrapper packages exist, but this library itself remains a dependency-free PHP solution.
- Is HTML Purifier actively maintained and suitable for long-term Laravel projects?
- HTML Purifier has a long history and ongoing repository activity, including CI builds. Because it is a pure PHP Composer package with no external dependencies, it fits naturally into Laravel projects and can be upgraded with Composer. Review release notes and PHP version constraints as part of your normal dependency maintenance.