Weave Code
Htmlawed Laravel Package
fossar/htmlawed
Fork of kesar/HTMLawed maintained by selfoss and wallabag. A single-file (~45KB) PHP HTML filter/sanitizer that secures and tidies user input, making it standards-compliant for HTML/XHTML/XML, with extensive customization options.
This is a fork of kesar/HTMLawed maintaining by selfoss & wallabag guys
Frequently asked questions about Htmlawed
- How do I install fossar/htmlawed in a Laravel project?
- Run `composer require fossar/htmlawed` in your project root. The package is a single-file dependency (~45KB) with no additional setup. Initialize it with `$htmlawed = new HTMLawed();` and chain methods like `sanitize()` or `allowTags()`.
- Does this package support Laravel 11 and PHP 8.3?
- Yes, fossar/htmlawed is compatible with Laravel 11 and PHP 8.3. The fork is based on kesar/HTMLawed v1.2.15, which includes PHP 8.3 compatibility. Test thoroughly for edge cases like typed class constants if using newer PHP features.
- Can I use <details> and <summary> tags in Blade templates?
- Absolutely. First, whitelist the tags with `$htmlawed->allowTags(['details', 'summary']);`. Then use the sanitized output in Blade: `<details><summary>Click me</summary>{{ $htmlawed->sanitize($userInput) }}</details>`. This works seamlessly with Laravel’s Blade escaping.
- How do I handle legacy HTML with self-closing tags like <img/>?
- fossar/htmlawed now neutralizes invalid self-closing tags (e.g., `<img/>`) by default to prevent XSS. If your app relies on these, audit your HTML imports and update whitelists. Log sanitization failures to identify affected content during migration.
- Is this package actively maintained? Should I use it over kesar/HTMLawed?
- Yes, fossar/htmlawed is actively maintained by the selfoss and wallabag teams, with recent updates (v1.3.4) adding HTML5 features like `<details>` support. Use this fork if you need faster fixes or HTML5 compliance; contribute back to upstream when possible.
- How do I extend Laravel’s validation rules to use htmlawed?
- Add a custom validation rule macro in a service provider: `Rule::macro('sanitized_html', fn(array $allowedTags = ['details', 'summary']) => ...);`. Then use it in your validation: `$request->validate(['content' => 'sanitized_html']);`.
- Will this break existing HTML in my database?
- Potential risks exist if your database contains malformed HTML (e.g., `<br/>`). Test with a sample dataset first. Use `$htmlawed->allowTags(['br'])` to preserve specific tags, but avoid whitelisting unsafe tags like `<script>`.
- How do I allow custom attributes for <details> (e.g., 'open')?
- Use `$htmlawed->allowAttributes(['details' => ['open']]);` to permit specific attributes. This is useful for Laravel apps using collapsible sections. Combine with `allowTags()` for full control over interactive elements.
- Does this package protect against XSS in SVG or script tags?
- By default, fossar/htmlawed blocks `<script>` and `<svg>` tags to prevent XSS. Explicitly whitelist SVG if needed (e.g., `$htmlawed->allowTags(['svg'])`), but validate all dynamic content. Test with edge cases like `<script/>` or `<iframe/>` to ensure security.
- What alternatives exist for HTML sanitization in Laravel?
- Alternatives include `HTMLPurifier` (heavyweight but robust), `symfony/dom` (for parsing only), or `masterminds/html5` (for parsing/serializing). fossar/htmlawed stands out for its lightweight size (~45KB), HTML5 compliance, and Laravel-friendly API. Choose based on your need for customization vs. performance.
Weaver
How can I help you explore Laravel packages today?