PHPackages                             phlib/xss-sanitizer - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Validation & Sanitization](/categories/validation)
4. /
5. phlib/xss-sanitizer

ActiveLibrary[Validation & Sanitization](/categories/validation)

phlib/xss-sanitizer
===================

PHP XSS sanitizer tool for HTML

2.1.0(2y ago)16180.9k↓14.8%3[1 issues](https://github.com/phlib/xss-sanitizer/issues)2LGPL-3.0PHPPHP ^7.4 || ^8.0CI failing

Since Mar 18Pushed 4mo ago6 watchersCompare

[ Source](https://github.com/phlib/xss-sanitizer)[ Packagist](https://packagist.org/packages/phlib/xss-sanitizer)[ RSS](/packages/phlib-xss-sanitizer/feed)WikiDiscussions main Synced 3d ago

READMEChangelog (7)Dependencies (2)Versions (10)Used By (2)

phlib/xss-sanitizer
===================

[](#phlibxss-sanitizer)

[![Code Checks](https://camo.githubusercontent.com/70e16802b7cc4ebbc94213735264420abb8faacc9be286602b8b8c1a84429c8c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f70686c69622f7873732d73616e6974697a65722f636f64652d636865636b732e796d6c3f6c6f676f3d676974687562)](https://github.com/phlib/xss-sanitizer/actions/workflows/code-checks.yml)[![Codecov](https://camo.githubusercontent.com/16ee2cb297ad48c7082cc902295e5b9d3018b10287e5fb9a5fba2ea703ef7966/68747470733a2f2f696d672e736869656c64732e696f2f636f6465636f762f632f6769746875622f70686c69622f7873732d73616e6974697a65722e7376673f6c6f676f3d636f6465636f76)](https://codecov.io/gh/phlib/xss-sanitizer)[![Latest Stable Version](https://camo.githubusercontent.com/dd1611ccebd251e36fb36d4e5808c4de7531db890094c346a0b84317b79bcb32/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f70686c69622f7873732d73616e6974697a65722e7376673f6c6f676f3d7061636b6167697374)](https://packagist.org/packages/phlib/xss-sanitizer)[![Total Downloads](https://camo.githubusercontent.com/74b562e3454abb419834aedd2743e57f665f43d661df47e88f31ac2bb83313ad/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f70686c69622f7873732d73616e6974697a65722e7376673f6c6f676f3d7061636b6167697374)](https://packagist.org/packages/phlib/xss-sanitizer)[![Licence](https://camo.githubusercontent.com/35044ffe7165a8b7873103db3c5dfb18f62f720e6bebe8cc9395e8b56c19ba9c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f70686c69622f7873732d73616e6974697a65722e737667)](https://camo.githubusercontent.com/35044ffe7165a8b7873103db3c5dfb18f62f720e6bebe8cc9395e8b56c19ba9c/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f70686c69622f7873732d73616e6974697a65722e737667)

PHP XSS sanitizer tool for HTML

Disclaimer
----------

[](#disclaimer)

Use [HTML Purifier](http://htmlpurifier.org/).

This library was created to try to solve the problem of XSS sanitization without using a permissive list, since the HTML which is being sanitized may contain non-standard or unusual syntax (e.g. HTML for emails).

This library is also intended for a limited use case whereby it is assumed that the sanitized HTML is only going to be displayed in a limited set of supported browsers (e.g. no need to strip 'vbscript:' code).

Install
-------

[](#install)

Via Composer

```
$ composer require phlib/xss-sanitizer
```

Usage
-----

[](#usage)

Create a sanitizer and sanitize some input:

```
$sanitizer = new \Phlib\XssSanitizer\Sanitizer();
$sanitized = $sanitizer->sanitize($htmlInput);
```

Optionally, extra tags and/or attributes can be specified to be removed, in addition to the defaults:

```
$removeBlocks = ['xss'];
$removeAttributes = ['onwebkittransitionend'];
$sanitizer = new \Phlib\XssSanitizer\Sanitizer($removeBlocks, $removeAttributes);
$sanitized = $sanitizer->sanitize($htmlInput);
```

Supported Browsers
------------------

[](#supported-browsers)

This library is intended to prevent XSS vulnerabilities when the resulting HTML is rendered by any of the following browsers:

- Chrome (40+)
- Firefox (40+)
- Safari (8+)
- IE (10, 11)
- Edge

License
-------

[](#license)

This package is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with this program. If not, see .

###  Health Score

50

—

FairBetter than 95% of packages

Maintenance49

Moderate activity, may be stable

Popularity42

Moderate usage in the ecosystem

Community20

Small or concentrated contributor base

Maturity74

Established project with proven stability

 Bus Factor1

Top contributor holds 96.9% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~428 days

Recently: every ~182 days

Total

8

Last Release

757d ago

Major Versions

1.1.0 → 2.0.02021-09-17

1.1.1 → 2.0.22023-08-01

PHP version history (2 changes)1.0.0PHP >=5.5.0

2.0.0PHP ^7.4 || ^8.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/135b7ddf9ec91c412e1b18174f81d1ad2bef66e732624195c156717c96b13731?d=identicon)[letssurf](/maintainers/letssurf)

![](https://www.gravatar.com/avatar/10c53cdcfb3a6d299820aecb993521cc1a972baa09fd8f31d2468908cded7e1d?d=identicon)[chrisminett](/maintainers/chrisminett)

---

Top Contributors

[![chrisminett](https://avatars.githubusercontent.com/u/1084019?v=4)](https://github.com/chrisminett "chrisminett (63 commits)")[![jdempster](https://avatars.githubusercontent.com/u/10297?v=4)](https://github.com/jdempster "jdempster (1 commits)")[![VincentLanglet](https://avatars.githubusercontent.com/u/9052536?v=4)](https://github.com/VincentLanglet "VincentLanglet (1 commits)")

###  Code Quality

TestsPHPUnit

Code StyleECS

### Embed Badge

![Health badge](/badges/phlib-xss-sanitizer/health.svg)

```
[![Health](https://phpackages.com/badges/phlib-xss-sanitizer/health.svg)](https://phpackages.com/packages/phlib-xss-sanitizer)
```

###  Alternatives

[marcosh/php-validation-dsl

A DSL for validating data in a functional fashion

483.9k](/packages/marcosh-php-validation-dsl)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)