PHPackages                             phlib/xss-sanitizer - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Validation & Sanitization](/categories/validation)
4. /
5. phlib/xss-sanitizer

ActiveLibrary[Validation & Sanitization](/categories/validation)

phlib/xss-sanitizer
===================

PHP XSS sanitizer tool for HTML

2.1.0(1y ago)16165.1k↑25.3%3[1 issues](https://github.com/phlib/xss-sanitizer/issues)1LGPL-3.0PHPPHP ^7.4 || ^8.0CI passing

Since Mar 18Pushed 3mo ago6 watchersCompare

[ Source](https://github.com/phlib/xss-sanitizer)[ Packagist](https://packagist.org/packages/phlib/xss-sanitizer)[ RSS](/packages/phlib-xss-sanitizer/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (7)Dependencies (2)Versions (10)Used By (1)

phlib/xss-sanitizer
===================

[](#phlibxss-sanitizer)

[![Code Checks](https://camo.githubusercontent.com/70e16802b7cc4ebbc94213735264420abb8faacc9be286602b8b8c1a84429c8c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f70686c69622f7873732d73616e6974697a65722f636f64652d636865636b732e796d6c3f6c6f676f3d676974687562)](https://github.com/phlib/xss-sanitizer/actions/workflows/code-checks.yml)[![Codecov](https://camo.githubusercontent.com/16ee2cb297ad48c7082cc902295e5b9d3018b10287e5fb9a5fba2ea703ef7966/68747470733a2f2f696d672e736869656c64732e696f2f636f6465636f762f632f6769746875622f70686c69622f7873732d73616e6974697a65722e7376673f6c6f676f3d636f6465636f76)](https://codecov.io/gh/phlib/xss-sanitizer)[![Latest Stable Version](https://camo.githubusercontent.com/dd1611ccebd251e36fb36d4e5808c4de7531db890094c346a0b84317b79bcb32/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f70686c69622f7873732d73616e6974697a65722e7376673f6c6f676f3d7061636b6167697374)](https://packagist.org/packages/phlib/xss-sanitizer)[![Total Downloads](https://camo.githubusercontent.com/74b562e3454abb419834aedd2743e57f665f43d661df47e88f31ac2bb83313ad/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f70686c69622f7873732d73616e6974697a65722e7376673f6c6f676f3d7061636b6167697374)](https://packagist.org/packages/phlib/xss-sanitizer)[![Licence](https://camo.githubusercontent.com/35044ffe7165a8b7873103db3c5dfb18f62f720e6bebe8cc9395e8b56c19ba9c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f70686c69622f7873732d73616e6974697a65722e737667)](https://camo.githubusercontent.com/35044ffe7165a8b7873103db3c5dfb18f62f720e6bebe8cc9395e8b56c19ba9c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f70686c69622f7873732d73616e6974697a65722e737667)

PHP XSS sanitizer tool for HTML

Disclaimer
----------

[](#disclaimer)

Use [HTML Purifier](http://htmlpurifier.org/).

This library was created to try to solve the problem of XSS sanitization without using a permissive list, since the HTML which is being sanitized may contain non-standard or unusual syntax (e.g. HTML for emails).

This library is also intended for a limited use case whereby it is assumed that the sanitized HTML is only going to be displayed in a limited set of supported browsers (e.g. no need to strip 'vbscript:' code).

Install
-------

[](#install)

Via Composer

```
$ composer require phlib/xss-sanitizer
```

Usage
-----

[](#usage)

Create a sanitizer and sanitize some input:

```
$sanitizer = new \Phlib\XssSanitizer\Sanitizer();
$sanitized = $sanitizer->sanitize($htmlInput);
```

Optionally, extra tags and/or attributes can be specified to be removed, in addition to the defaults:

```
$removeBlocks = ['xss'];
$removeAttributes = ['onwebkittransitionend'];
$sanitizer = new \Phlib\XssSanitizer\Sanitizer($removeBlocks, $removeAttributes);
$sanitized = $sanitizer->sanitize($htmlInput);
```

Supported Browsers
------------------

[](#supported-browsers)

This library is intended to prevent XSS vulnerabilities when the resulting HTML is rendered by any of the following browsers:

- Chrome (40+)
- Firefox (40+)
- Safari (8+)
- IE (10, 11)
- Edge

License
-------

[](#license)

This package is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with this program. If not, see .

###  Health Score

52

—

FairBetter than 96% of packages

Maintenance58

Moderate activity, may be stable

Popularity42

Moderate usage in the ecosystem

Community18

Small or concentrated contributor base

Maturity74

Established project with proven stability

 Bus Factor1

Top contributor holds 96.9% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~428 days

Recently: every ~182 days

Total

8

Last Release

709d ago

Major Versions

1.1.0 → 2.0.02021-09-17

1.1.1 → 2.0.22023-08-01

PHP version history (2 changes)1.0.0PHP >=5.5.0

2.0.0PHP ^7.4 || ^8.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/135b7ddf9ec91c412e1b18174f81d1ad2bef66e732624195c156717c96b13731?d=identicon)[letssurf](/maintainers/letssurf)

![](https://www.gravatar.com/avatar/10c53cdcfb3a6d299820aecb993521cc1a972baa09fd8f31d2468908cded7e1d?d=identicon)[chrisminett](/maintainers/chrisminett)

---

Top Contributors

[![chrisminett](https://avatars.githubusercontent.com/u/1084019?v=4)](https://github.com/chrisminett "chrisminett (63 commits)")[![jdempster](https://avatars.githubusercontent.com/u/10297?v=4)](https://github.com/jdempster "jdempster (1 commits)")[![VincentLanglet](https://avatars.githubusercontent.com/u/9052536?v=4)](https://github.com/VincentLanglet "VincentLanglet (1 commits)")

###  Code Quality

TestsPHPUnit

Code StyleECS

### Embed Badge

![Health badge](/badges/phlib-xss-sanitizer/health.svg)

```
[![Health](https://phpackages.com/badges/phlib-xss-sanitizer/health.svg)](https://phpackages.com/packages/phlib-xss-sanitizer)
```

###  Alternatives

[webmozart/assert

Assertions to validate method input/output with nice error messages.

7.6k894.0M1.2k](/packages/webmozart-assert)[bensampo/laravel-enum

Simple, extensible and powerful enumeration implementation for Laravel.

2.0k15.9M104](/packages/bensampo-laravel-enum)[swaggest/json-schema

High definition PHP structures with JSON-schema based validation

48612.5M73](/packages/swaggest-json-schema)[stevebauman/purify

An HTML Purifier / Sanitizer for Laravel

5325.6M19](/packages/stevebauman-purify)[ashallendesign/laravel-config-validator

A package for validating your Laravel app's config.

217905.3k5](/packages/ashallendesign-laravel-config-validator)[crazybooot/base64-validation

Laravel validators for base64 encoded files

1341.9M8](/packages/crazybooot-base64-validation)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)