A Laravel service provider for HTMLPurifier, enabling secure HTML filtering and XSS prevention.
Purifier is a Laravel service provider that integrates HTMLPurifier, a standards-compliant HTML filter library, into Laravel applications. It sanitizes user-generated HTML content to prevent XSS attacks and ensure W3C compliance, making it safe to use WYSIWYG editors or accept HTML input.
Laravel developers building applications that accept user-generated HTML content, such as CMS platforms, forums, or comment systems.
Developers choose Purifier for its seamless Laravel integration, robust security features from HTMLPurifier, and flexible configuration options, eliminating the need to manually implement complex HTML sanitization logic.
HTMLPurifier for Laravel 5+
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a service provider, facade, and Eloquent casts (CleanHtml, CleanHtmlInput, CleanHtmlOutput) for native use within Laravel apps, streamlining HTML sanitization in models and requests.
Leverages HTMLPurifier's audited, permissive whitelist to remove malicious code, ensuring secure handling of user-generated HTML from sources like WYSIWYG editors.
Supports publishable config files with pre-set profiles (e.g., for YouTube embeds) and dynamic per-call configurations, allowing tailored filtering rules for different use cases.
Ensures output adheres to W3C specifications via HTMLPurifier, improving document quality and compatibility across browsers, which is highlighted in the package description.
HTMLPurifier's settings are intricate and require manual tuning in config/purifier.php, which can be overwhelming for developers unfamiliar with its extensive options.
HTMLPurifier is resource-intensive, and enabling caching (default in config) adds storage requirements, potentially slowing down high-traffic applications.
Breaking changes or updates in the underlying HTMLPurifier library could affect stability, as this package acts as a wrapper without full control over core functionality.