Weave Code
Filter Laravel Package
joomla/filter
joomla/filter provides input and output filtering tools for PHP apps, helping sanitize content by allowing or blocking specific HTML tags and attributes. Includes OutputFilter helpers (e.g., URL-safe strings; optional Joomla\Language).
Joomla Framework Filter Package
Frequently asked questions about Filter
- How do I install joomla/filter in a Laravel project?
- Run `composer require joomla/filter ~3.0` to install the latest stable version. For development, use `--prefer-source` to include test sources. Ensure your Laravel app uses PHP 8.1+ for compatibility.
- Does joomla/filter work with Laravel’s Blade templating?
- Yes, but be cautious—Laravel’s Blade auto-escapes output via `{{ }}` or `e()`. Use `InputFilter::clean()` for manual sanitization before rendering, then rely on Blade’s escaping for final output.
- Can I use this package for URL sanitization in Laravel?
- Yes, but the `OutputFilter::stringURLSafe` feature requires the optional `joomla/language` package. For basic URL sanitization, Laravel’s `Str::of()->slug()` or `Str::ascii()` may suffice without extra dependencies.
- What Laravel versions does joomla/filter support?
- The package requires PHP 8.1+ (v3.x) or 8.3+ (v4.x), aligning with Laravel 9+ and 10+. Check your Laravel version’s PHP requirements before installing to avoid compatibility issues.
- How do I configure allowed HTML tags for user comments?
- Use `InputFilter::clean()` with `InputFilter::ONLY_ALLOW_DEFINED_TAGS` and pass an array of allowed tags, e.g., `['p', 'b', 'i']`. Example: `$filter->clean($input, InputFilter::ONLY_ALLOW_DEFINED_TAGS, ['p', 'b']);`
- Is joomla/filter a drop-in replacement for HTML Purifier?
- No. While both sanitize HTML, `joomla/filter` is lighter (~50KB) and lacks HTML Purifier’s advanced features (e.g., complex nested tag rules). Use HTML Purifier if you need granular control over edge cases.
- How do I integrate this into Laravel validation rules?
- Extend Laravel’s validation with a custom rule. Example: `Rule::custom(function ($value) { $filter = new InputFilter(); return $filter->clean($value, InputFilter::ONLY_ALLOW_DEFINED_TAGS, ['a']); })` in your `FormRequest` rules.
- Are there performance concerns for high-traffic APIs?
- The package is lightweight, but no Laravel-specific benchmarks exist. Test in staging with your expected load. For critical APIs, consider caching filtered results or using Laravel’s native `e()` for simple escaping.
- What’s the fallback if joomla/filter stops being maintained?
- Fork the package or migrate to Laravel’s built-in `e()` helper or `htmlpurifier/htmlpurifier`. The package’s simplicity means alternatives like `filter_var()` or `strip_tags()` can cover basic cases.
- Does this package protect against all OWASP XSS vectors?
- It mitigates common vectors (e.g., `<script>`, `javascript:`, `data:` URIs) but may not cover all OWASP XSS risks like SVG or CSS injection. Combine with Laravel’s CSRF protection and input validation for robust security.
Weaver
How can I help you explore Laravel packages today?