- What is luketowers/purifier used for in Laravel?
- luketowers/purifier is a Laravel 5 wrapper around HTMLPurifier for server-side sanitization of user-supplied HTML. It helps clean rich-text fields, comments, CMS content, support tickets, and profile bios so unsafe markup and scripts are removed. It provides a Purifier facade, Blade directive, service provider, and publishable configuration.
- How do I install luketowers/purifier in a Laravel 5 application?
- Install it with Composer, then register the service provider and facade alias if your Laravel 5 version does not support package auto-discovery. You can optionally publish the configuration file to adjust HTMLPurifier profile settings. After that, sanitize HTML through the Purifier facade or the provided Blade directive.
- Does luketowers/purifier support Laravel 6, Laravel 8, or newer versions?
- The package is described as an HTMLPurifier wrapper for Laravel 5, so it should be treated as a Laravel 5.x integration rather than a modern Laravel package. For Laravel 6 and newer applications, a maintained wrapper or direct HTMLPurifier integration is usually the safer choice. Verify Composer constraints before assuming compatibility with any newer Laravel release.
- How do I use the Purifier facade or Blade directive to clean HTML?
- The typical facade call is Purifier::clean($html), which returns sanitized HTML according to your configured HTMLPurifier profile. The package also exposes a Blade directive for template usage, but you should confirm the exact directive syntax in the README for your installed version. Keep purification close to the point where user HTML is accepted or rendered.
- Is luketowers/purifier safe to use in production?
- HTMLPurifier itself is a mature HTML sanitizer, but this wrapper appears low-adoption and may be unmaintained, so production use carries lifecycle risk. Pin exact Composer versions, test with representative XSS payloads, and wrap the package behind an application-owned sanitizer interface. Treat it as internally owned code and monitor advisories, because Laravel 5 is end-of-life.
- Can luketowers/purifier prevent all XSS attacks?
- No. Sanitizing HTML reduces XSS risk for user-generated rich content, but it is not a replacement for contextual output escaping, a Content Security Policy, or a WAF. Use purification alongside escaped output and secure template practices. Do not treat HTMLPurifier as a general security control for every output context.
- How do I configure allowed HTML tags with luketowers/purifier?
- Publish the package configuration and define the HTMLPurifier profile settings you need, including allowed tags and attributes. Because HTMLPurifier is configuration-sensitive, test the published config under your actual PHP runtime and with config caching enabled. Also verify service provider boot order so the sanitizer receives the intended profile.
- What PHP and Laravel versions does luketowers/purifier require?
- The package is positioned for Laravel 5 applications, and its PHP compatibility is likely narrow because Laravel 5 is end-of-life. Check the Composer constraints for laravel/framework and ezyang/htmlpurifier before adoption. Test on the exact PHP version used in production rather than relying only on local tooling.
- Is luketowers/purifier actively maintained?
- It appears to be a low-adoption package with limited community activity, so you should not expect vendor support or frequent upstream fixes. Plan to monitor security advisories, vendor-patch if necessary, and budget time for dependency reviews. At least one engineer should understand HTMLPurifier profiles and the allowed-tag policy.
- What are alternatives to luketowers/purifier for sanitizing HTML in Laravel?
- For Laravel 5, you can use direct ezyang/htmlpurifier integration or a maintained Laravel wrapper if one fits your version constraints. For Laravel 6 and newer, prefer a maintained package or direct HTMLPurifier integration rather than adopting this Laravel 5 wrapper. In all cases, isolate sanitization behind an internal interface so you can replace the implementation during upgrades.