Weave Code
Sanitizer Laravel Package
waavi/sanitizer
Waavi Sanitizer provides a simple, flexible way to clean and transform user input in Laravel before validation. Define reusable sanitizers with built-in filters like trim, escape, cast, and custom filters to keep your data safe and consistent.
Data sanitizer and Laravel 7 form requests with input sanitation.
Frequently asked questions about Sanitizer
- What is Waavi Sanitizer used for in Laravel?
- Waavi Sanitizer is used to clean and transform user input before validation in Laravel applications. It provides a SanitizedRequest base class for form requests and a standalone Sanitizer service or facade for non-HTTP input. You define reusable filters such as trim, escape, cast, and custom filters so controllers receive normalized data.
- How do I install waavi/sanitizer in a Laravel 7 app?
- Install it with Composer using the waavi/sanitizer package name, then publish the package configuration if your setup requires it. Extend the package's sanitized request base class for form requests and declare your filters. The TPM assessment notes this is low-effort in a Laravel 7 app and a developer can be productive in a day.
- Does waavi/sanitizer support Laravel 8, 9, 10, or 11?
- The package is positioned for Laravel 7-era applications and PHP 7.x, and the TPM assessment warns of likely Composer resolution conflicts on Laravel 9+ and PHP 8.2+ estates. Laravel 7 reached end of life in March 2021, and the package is effectively unmaintained. For newer Laravel versions, treat adoption as a fork decision or use native prepareForValidation instead.
- How do I configure sanitization filters for a form request?
- Extend the package's SanitizedRequest class and declare the filters for each request input. Built-in filters cover common operations like trim, escape, and cast, and you can add custom filters for project-specific normalization. The package applies sanitation before validation so your rules evaluate the cleaned values.
- Can I use waavi/sanitizer outside HTTP requests?
- Yes, the package includes a standalone Sanitizer service or facade intended for non-HTTP ingestion such as queues, CLI imports, or webhooks. That makes it useful when you need the same filter definitions at multiple input boundaries. The TPM assessment cautions that if you only need HTTP request sanitation, native prepareForValidation plus middleware may suffice.
- How does waavi/sanitizer interact with Laravel validation?
- Sanitizers rewrite request input before Laravel validation runs, so validation sees the trimmed, escaped, or cast values rather than the raw input. This is convenient but can create ordering semantics where a value passes a rule only because it was transformed first. The TPM assessment flags this as a debugging and audit concern because what validation sees, what logs record, and what is persisted can diverge.
- Is waavi/sanitizer safe for production use?
- The code surface is small and MIT-licensed, but the TPM assessment rates technical risk high because upstream is effectively unmaintained and targets Laravel 7 and PHP 7.x. Production concerns include silent input mutation, ordering semantics between sanitation and validation, and lack of security response for newer PHP versions. Pin exact versions, add a CI gate for framework upgrades, and isolate package references at the request boundary.
- What are the alternatives to waavi/sanitizer in Laravel?
- Laravel's native FormRequest::prepareForValidation has covered roughly the same use case since Laravel 5.5, and middleware or a small internal sanitizer registry can handle non-request input. DTO and mapping libraries are another option for normalizing data before validation. The TPM assessment recommends porting required behavior into a project-owned base request class to remove the dependency.
- How do I test sanitization rules with waavi/sanitizer?
- Test the request classes and filter definitions directly, asserting that raw input is transformed before validation rules run. Because the package is small, you can also carry tests with it if you fork and vendor it under an internal namespace. Wrap package references behind an internal interface or request boundary so tests and future swaps stay localized.
- Is waavi/sanitizer maintained, and can we fork it?
- The TPM assessment says upstream is effectively unmaintained, with no security response and no PHP 8.x guarantees. The MIT license and small surface area make forking legally and technically viable, but you must own the code and its test suite. Fork it under an internal namespace only if the package's filter vocabulary is already relied upon, and avoid introducing it into greenfield code.
Weaver
How can I help you explore Laravel packages today?