Weave Code
Html Sanitizer Laravel Package
symfony/html-sanitizer
Symfony's HtmlSanitizer component offers an object-oriented API to clean untrusted HTML for safe DOM insertion. Configure allowed elements, attributes, link schemes, and URL forcing to strip scripts and dangerous markup.
Provides an object-oriented API to sanitize untrusted HTML input for safe insertion into a document's DOM.
Frequently asked questions about Html Sanitizer
- How do I install symfony/html-sanitizer in a Laravel app?
- Run composer require symfony/html-sanitizer in your Laravel project. No Laravel-specific wrapper is required, so the next step is binding Symfony\Component\HtmlSanitizer\HtmlSanitizer in a service provider or config file. Once registered as a singleton with your HtmlSanitizerConfig, Laravel's container can inject it anywhere.
- Which PHP and Laravel versions does symfony/html-sanitizer support?
- The component is framework-agnostic and follows Symfony's release cycle, so current versions require PHP 8.2 or newer and run fine on Laravel 10, 11, and 12. PHP 8.4 is the biggest win because the sanitizer can then use PHP's native HTML5 parser. Older PHP versions fall back to the Masterminds parser, which is slower and deprecated in Symfony 8, so run 8.4 in production if sanitization is on a hot path.
- How do I register the sanitizer as a singleton and call it through a facade in Laravel?
- Create a small service provider that builds an HtmlSanitizerConfig, wraps it in new HtmlSanitizer($config), and registers the instance as a singleton. Add a facade or use typed constructor injection so controllers, form requests, and jobs all call sanitize() the same way. The sanitizer is stateless once configured, so a singleton avoids rebuilding the rule set on every request.
- How do I allow only certain HTML tags and attributes?
- Start with allowSafeElements() to permit the W3C safe list, which already strips scripts and dangerous markup, then narrow or extend it. Use allowElement('a', ['href', 'title']) to permit an element with specific attributes, blockElement() to remove a tag but keep its children, and dropElement() to remove the tag and everything inside it. Anything not explicitly allowed is dropped, which is the safest default.
- Should I use HtmlSanitizer or Blade escaping to prevent XSS?
- Blade's double curly braces escape text and should stay in place for anything rendered as plain text. HtmlSanitizer covers the opposite case: HTML you intentionally want rendered as markup, such as rich-text editor output, comments, or CMS content. Use both, and never output with {!! !!} unless the value has passed through the sanitizer first.
- How do I stop javascript: links and force https in sanitized HTML?
- Configure allowLinkSchemes(['https', 'http', 'mailto']) so javascript:, data:, and other schemes are stripped from href values. forceHttpsUrls() rewrites http links to https, and forceAttribute('a', 'rel', 'noopener noreferrer') hardens links that open in new tabs. You can also restrict allowed hosts if your application should not link off-site.
- Can I use different sanitization rules for contexts like head or textarea?
- Pass a map of per-context configs as the second argument to the HtmlSanitizer constructor, for example ['head' => $headConfig, 'textarea' => $textareaConfig], then call sanitizeFor('head', $input). Each context has different rules in the W3C Sanitizer API, which keeps head-only elements out of body content. If you do not need separate rule sets, a single sanitize() call is enough.
- Is symfony/html-sanitizer fast enough for large HTML inputs or global middleware?
- The native PHP 8.4 parser handles comment- and article-sized input quickly, but multi-megabyte HTML will add noticeable latency. Benchmark your real payloads before applying the sanitizer to every request, and cache sanitized output for repeated content such as stored CMS blocks. For global input filtering, run it only on fields you know contain HTML rather than all request data.
- How does symfony/html-sanitizer compare to HTMLPurifier or DOMDocument?
- HTMLPurifier is battle-tested and highly configurable but heavy, with a slower parser and a steeper configuration model. Raw DOMDocument is native and dependency-free but leaves decisions like safe attributes and URL schemes entirely to you. symfony/html-sanitizer sits in the middle: lightweight, modern, context-aware, and simple to configure, though its documentation and community examples are thinner than HTMLPurifier's.
- How should I test and maintain sanitization rules in a Laravel app?
- Write unit tests that push malformed HTML, nested tags, event-handler attributes, and javascript: URLs through your configured sanitizer and assert the exact output. Add fuzz or property-based tests if you accept truly untrusted input, and keep OWASP ZAP or similar in your pipeline for end-to-end checks. The component is maintained by the Symfony core team and shipped with Symfony releases, so pin your version and review changelogs when upgrading PHP or Laravel.
Weaver
How can I help you explore Laravel packages today?