- How do I install stevebauman/purify in my Laravel project?
- Run `composer require stevebauman/purify` in your project root, then publish the config file with `php artisan vendor:publish --provider="Stevebauman\Purify\PurifyServiceProvider"`. No additional setup is required for basic usage.
- Can I sanitize an entire array of HTML strings at once?
- Yes. Use `Purify::clean($array)` to sanitize all elements in an array simultaneously. Each string is processed with the default or specified configuration rules.
- What Laravel versions does stevebauman/purify support?
- The package supports Laravel 7.0 and above. It requires PHP 7.4+ and is compatible with modern Laravel LTS releases. Check the [README](https://github.com/stevebauman/purify) for version-specific notes.
- How do I override the default sanitization rules for a specific input?
- Pass a custom configuration array as the second argument to `Purify::clean($input, $config)`. For example, allow `<strong>` tags only: `Purify::clean($input, ['HTML.Allowed' => 'strong'])`.
- Does stevebauman/purify work with WYSIWYG editors like Trix or CKEditor?
- Yes, but you’ll need to extend the default configuration. The package supports custom HTML/CSS definitions. For Trix, you can use `TrixPurifierDefinitions` or define your own rules in the config file.
- How do I enable caching to improve performance?
- Caching is enabled by default in production. If disabled, set `'cache_enabled' => true` in the published config file. Clear the cache after config changes with `php artisan purify:clear`.
- What happens if I allow unsafe HTML tags (e.g., `<script>`) by mistake?
- This creates an XSS vulnerability. Always start with conservative defaults (e.g., `HTML.Allowed = 'p,b,strong,a[href]'`), test thoroughly, and use the `purify:clear` command to validate changes before deploying.
- Can I use stevebauman/purify with Eloquent model attributes?
- Yes. Use the `PurifyHtmlOnGet` and `PurifyHtmlOnSet` casts in your model to automatically sanitize HTML when saving or retrieving data. Example: `$casts = ['body' => PurifyHtmlOnSet::class];`
- What are the risks of disabling caching in production?
- Disabling caching increases CPU and memory usage, especially under high traffic. HTMLPurifier’s serialized definitions are cached by default in production. Monitor performance if caching is disabled.
- Are there alternatives to stevebauman/purify for Laravel HTML sanitization?
- Yes, alternatives include `laravel-sanitizer` (simpler but less flexible) or using `HTMLPurifier` directly. This package is preferred for its Laravel-native integration, dynamic config, and Eloquent support. Evaluate based on your need for customization vs. simplicity.