- How do I install and wire tgalopin/html-sanitizer into a Laravel app?
- Install it with composer require tgalopin/html-sanitizer. The core library is framework agnostic, so in Laravel you bind it as a singleton in a service provider and inject it through a narrow interface such as sanitize(string, Policy): string rather than instantiating it in controllers. Keep the policy definition in config so the allow-list is reviewable and versioned alongside your code.
- Is tgalopin/html-sanitizer still maintained?
- No. The package was archived on 2021-12-15 and receives no updates, PHP compatibility patches, or security advisories. Its lineage was folded into Symfony's own HTML Sanitizer component, which is the actively maintained successor. Treat this package as an interim bridge rather than a permanent dependency, and plan the migration before you ship it widely.
- Does tgalopin/html-sanitizer work with current Laravel and PHP versions?
- The library has no Laravel coupling, so it will install alongside any Laravel version that satisfies its Composer constraints, but the 2021-era release predates current PHP minor versions. Expect deprecation notices and eventually hard failures in CI on modern PHP. Test against both the oldest and newest PHP versions in your estate before committing, and budget for a fork if you must run it long term.
- How does this sanitizer prevent XSS compared to strip_tags or regex filtering?
- It parses the input with an HTML5-compliant parser and then applies a deny-by-default allow-list of tags, attributes, and URL protocols. That is fundamentally safer than regex blacklisting, which is the single largest source of historical XSS bypasses, and safer than strip_tags, which knows nothing about attributes or javascript: URLs. The trade-off is that its robustness is inherited from the masterminds/html5 parser dependency, not from the sanitizer itself.
- How do I create different sanitization policies for comments versus CMS content?
- Define a base policy owned centrally, then add per-surface extensions that permit only the markup each feature needs, such as anchors and tables for CMS bodies and plain text plus line breaks for comments. Sanitizers fail quietly, so stripping an attribute can silently break embedded video or anchor targets long after rollout without raising an error. Keep a test corpus per policy so unintended stripping shows up in CI rather than in production.
- Do I need Symfony to use tgalopin/html-sanitizer in Laravel?
- No. The core is framework agnostic and does not force a Symfony dependency into a Laravel codebase; the Symfony integration is an optional convenience layer. You only need the sanitizer plus its HTML5 parser dependency. Wire it through a Laravel service provider and keep your application code depending on your own interface, not on the vendor classes.
- What are the best alternatives or successors to tgalopin/html-sanitizer?
- The primary successor is Symfony's HTML Sanitizer component, which is aligned with the W3C Sanitizer API policy model and is actively maintained. Other options include HTML Purifier wrappers such as mews/purifier, which are heavier but long-lived. If you only need limited formatting, accepting a restricted Markdown subset removes most of the attack surface entirely.
- Should I sanitize HTML on write, on read, or both?
- The library is a pure, stateless string transformation, so it can run at either boundary. Sanitizing on write normalizes what you store, while sanitizing on read gives defense in depth if stored content was written by an older or buggier policy. Running it in both places is the safer posture for anything rendered in an admin console.
- How should I test HTML sanitization against XSS payloads?
- Build a regression corpus of hostile payloads, including mutation XSS, encoded javascript: URLs, and malformed nesting, and assert the exact sanitized output with PHPUnit data providers. Add cases for every attribute your product relies on so silent stripping is caught immediately. Re-run the corpus against any policy change and against every PHP upgrade.
- Is HTML sanitization fast enough for high-traffic Laravel pages?
- Parsing is linear in input size and typically measured in microseconds to low milliseconds per document, so it is usually fine outside hot render loops. Because it is stateless, you can cache sanitized output keyed by a hash of the raw input and policy version. Sanitizing on write and caching the result is the common pattern for high-traffic comment or CMS rendering.