A standards-compliant HTML filtering library for PHP that removes malicious code while preserving safe markup.
HTML Purifier is a PHP library that filters and sanitizes HTML input to remove malicious code while preserving safe, standards-compliant markup. It prevents cross-site scripting (XSS) attacks by using whitelists and aggressive parsing techniques, ensuring that user-generated HTML is both secure and valid according to W3C specifications.
PHP developers building applications that accept HTML input from users, such as content management systems, forums, comment systems, or any web platform where rich text formatting is allowed.
Developers choose HTML Purifier because it provides a reliable, standards-compliant solution for HTML sanitization that balances security with the need to preserve legitimate formatting, unlike simpler parsers that might break valid HTML or miss sophisticated attacks.
Standards compliant HTML filter written in PHP
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses whitelists and aggressive parsing to neutralize malicious scripts, ensuring security against sophisticated attacks, as highlighted in the README's focus on thwarting XSS.
Outputs HTML that adheres to W3C specifications, ensuring cross-browser compatibility and valid markup, which is a core feature for handling untrusted sources.
Designed to handle full HTML tag sets including CSS, making it ideal for sanitizing content from rich text editors like TinyMCE, as noted in the README.
Can be adjusted to accept more restrictive tag sets while maintaining correctness, allowing customization for different use cases without compromising security.
The README admits it is not as efficient as bare-bones parsers, making it slower for high-throughput applications where speed is critical.
Achieving the right balance between security and functionality requires detailed setup and tuning, which can be time-consuming and error-prone for developers.
Being a PHP library, it locks projects into the PHP ecosystem and cannot be easily ported to other programming environments without rewrites.