- What is larahook/purifier and what problem does it solve in Laravel?
- larahook/purifier is a Laravel wrapper around HTMLPurifier that cleans untrusted HTML before it reaches your views. It helps strip malicious or unwanted markup such as XSS payloads while preserving safe formatting from rich-text editors, comments, and CMS fields. It fits naturally into Laravel apps that accept user-generated HTML.
- How do I install and publish the config for larahook/purifier?
- Install it with Composer, then let Laravel service-provider auto-discovery register the package. Publish the configuration with php artisan vendor:publish and review the generated sanitization settings before using it. Verify the composer.json constraints first so the package installs cleanly on your Laravel and PHP matrix.
- Does larahook/purifier support Laravel 10, 11, and 12?
- The available information does not confirm exact Laravel framework or PHP version support, so check the package composer.json constraints before adopting it. A Laravel-era wrapper can declare illuminate/support constraints that block installation on newer versions. If that happens, fork and bump constraints rather than downgrading your application, then test the sanitization behavior.
- Is larahook/purifier a fork of mews/purifier?
- The provided material does not state whether larahook/purifier is a fork of mews/purifier, so verify the repository history and changelog. If you are migrating from mews/purifier, expect a namespace change, facade alias update, and config diff. Re-run your sanitization contract tests because default configurations can differ.
- How do I configure allowed HTML tags, attributes, and protocols?
- Publish the package config and define the HTML.Allowed rules, attribute allowlists, and URI schemes your application needs. Treat this as a security policy decision and back it with a test corpus of allowed and rejected markup. Keep the published config static and committed so it works with config:cache.
- Does larahook/purifier support HTML5 elements and data attributes?
- HTMLPurifier is an HTML4/XHTML-era sanitizer and does not natively understand HTML5 elements such as figure, video, or data-* attributes. You need custom configuration for modern markup, or content may be silently lost during sanitization. If your product depends on HTML5 output, evaluate an HTML5-aware sanitizer.
- Is larahook/purifier production-ready and what are the risks?
- The main risk is supply chain: low adoption means little community scrutiny and no independent confirmation that the wrapper tracks Laravel container and config changes. Treat it as vendored code your team owns, with a named owner for sanitization policy and upstream HTMLPurifier CVE response. HTMLPurifier itself is mature but in low-maintenance mode, so fixes may land upstream rather than in this wrapper.
- How should I handle HTMLPurifier caching and performance in Laravel?
- HTMLPurifier is DOM-based and can cost hundreds of milliseconds per large document if its definition cache is not configured correctly. The package may not configure a filesystem or APCu definition cache out of the box, so plan to own that wiring. In immutable or containerized deployments, create the cache directory during image build or startup.
- What alternatives to larahook/purifier should I consider?
- Consider Symfony HtmlSanitizer, which is HTML5-aware and actively maintained, or an application-owned sanitizer interface that can hide either implementation. For API-only or headless services, sanitization may belong in the consuming client or a modern allowlist sanitizer. The cheapest insurance is an app-owned purify(string $html): string boundary so you can swap packages without touching call sites.
- How do I integrate and test larahook/purifier safely in a Laravel app?
- Do not call the facade directly from controllers or models; introduce an application-owned Sanitizer interface and bind the package behind it. Publish and commit the config, define an allowlist policy, and add contract tests covering allowed formatting and rejected XSS payloads. Verify installation on your Laravel and PHP matrix, and re-run those tests if you migrate from another purifier wrapper.