PHPackages vanilla/htmlawed - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Validation & Sanitization](/categories/validation) 4. / 5. vanilla/htmlawed ActiveLibrary[Validation & Sanitization](/categories/validation) vanilla/htmlawed ================ A composer wrapper for the htmLawed library to purify & filter HTML. Tested with PHPUnit and PhantomJS! v2.2.15(2y ago)42603.4k↓16%15[1 PRs](https://github.com/vanilla/htmlawed/pulls)5LGPL-3.0HTMLPHP >=7.4.0 Since Jul 16Pushed 2y ago15 watchersCompare [ Source](https://github.com/vanilla/htmlawed)[ Packagist](https://packagist.org/packages/vanilla/htmlawed)[ RSS](/packages/vanilla-htmlawed/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (10)Dependencies (2)Versions (19)Used By (5) htmLawed ======== [](#htmlawed) [![Build Status](https://camo.githubusercontent.com/b988116c13e1fcf1153382c08181bb8474d701d314290b354a936fc1719df32d/68747470733a2f2f696d672e736869656c64732e696f2f7472617669732f76616e696c6c612f68746d6c617765642e7376673f7374796c653d666c6174)](https://travis-ci.org/vanilla/htmlawed)[![Coverage](https://camo.githubusercontent.com/7e0f1665c2b0505c4a401c2d3e42ab8f69887c54c734830d60692e98adb763ae/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f636f7665726167652f672f76616e696c6c612f68746d6c617765642e7376673f7374796c653d666c6174)](https://scrutinizer-ci.com/g/vanilla/htmlawed/)[![Packagist Version](https://camo.githubusercontent.com/ab3208984730f0eab5d4c0143d1953d1ad2fd451e7024dd10eeaaadbbbf4d881/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f76616e696c6c612f68746d6c617765642e7376673f7374796c653d666c6174)](https://packagist.org/packages/vanilla/htmlawed)[![LGPL-3.0](https://camo.githubusercontent.com/5e94f431c0ecb5897a9c9dd634956d920dfd4df41ec02e5c17d080c821833752/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f76616e696c6c612f68746d6c617765642e7376673f7374796c653d666c6174)](https://camo.githubusercontent.com/5e94f431c0ecb5897a9c9dd634956d920dfd4df41ec02e5c17d080c821833752/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f76616e696c6c612f68746d6c617765642e7376673f7374796c653d666c6174) A composer wrapper for the [htmLawed](http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/) library to purify & filter HTML. Tested with [PHPUnit](http://phpunit.de/) and [PhantomJS](http://phantomjs.org/). Why use htmLawed? ----------------- [](#why-use-htmlawed) If your website has any user-generated content then you need to worry about [cross-site scripting (XSS)](http://en.wikipedia.org/wiki/Cross-site_scripting). htmLawed will take a piece of potentially malicious html and remove the malicious code, leaving the rest of html behind. Beyond the base htmLawed library, this package makes htmLawed a composer package and wraps it in an object so that it can be autoloaded. Installation ------------ [](#installation) *htmLawed requres PHP 5.4 or higher* htmLawed is [PSR-4](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-4-autoloader.md) compliant and can be installed using [composer](//getcomposer.org). Just add `vanilla/htmlawed` to your composer.json. ``` "require": { "vanilla/htmlawed": "~1.0" } ``` Example ------- [](#example) ``` echo Htmlawed::filter('Hello world!'); // Outputs: 'Hello world!'. echo Htmlawed::filter('nothing to seealert("xss")') // Outputs: 'nothing to seealert("xss")' ``` Configs and Specs ----------------- [](#configs-and-specs) The htmLawed filter takes two optional parameters: `$config` and `$spec`. This library provides sensible defaults to these parameters, but you can override them in `Htmlawed::filter()`. ``` $xss = "nothing to see alert('xss')"; // Pass an empty config and spec for no filtering of malicious code. echo Htmlawed::filter($xss, [], []); // Outputs: 'nothing to see alert("xss")' // Pass safe=1 to turn on all the safe options. echo Htmlawed::filter($xss, ['safe' => 1]); // Outputs: 'nothing to see alert("xss")' // We provide a convenience method that strips all tags that aren't supposed to be in rss feeds. echo Htmlawed::filterRSS('Hello world!'); // Outputs: 'Hello world!' ``` See the [htmLawed documentation](http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s2.2) for the full list of options. Differences in Vanilla's version of Htmlawed -------------------------------------------- [](#differences-in-vanillas-version-of-htmlawed) We try and use the most recent version of htmLawed with as few changes as possible so that bug fixes and security releases can be merged from the main project. However, We've made a few changes in the source code. - Balance tags (hl\_bal) before validating tags (hl\_tag). We found some cases where an unbalanced script tag would not get removed and this addresses that issue. - Don't add an extra `` inside of `` tags. - Remove naked ``. - Change indentation from 1 space to 4 spaces. *If the original author of htmLawed wants to make any of these changes upstream please get in contact with .* ### Health Score 46 — FairBetter than 93% of packages Maintenance20 Infrequent updates — may be unmaintained Popularity50 Moderate usage in the ecosystem Community31 Small or concentrated contributor base Maturity72 Established project with proven stability Bus Factor1 Top contributor holds 61.8% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~240 days Recently: every ~582 days Total 15 Last Release 962d ago Major Versions v1.2.4 → v2.1.222016-04-14 PHP version history (2 changes)v1.0.0PHP >=5.4.0 v2.2.15PHP >=7.4.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/da29e060f227028e8ee38bb5873ba2188fb5236b20b3dffec766c768019d8bd8?d=identicon)[tburry](/maintainers/tburry) ![](https://www.gravatar.com/avatar/ea17fedfd653c4692cf93a4faada50927cef9537dafed0dd4b1517e54fd71728?d=identicon)[charrondev](/maintainers/charrondev) ![](https://www.gravatar.com/avatar/021b2a80f2781914dbb04a3aec8fa98a286915043f9b695cc158416c0c681b1e?d=identicon)[kaecyra](/maintainers/kaecyra) --- Top Contributors [![tburry](https://avatars.githubusercontent.com/u/97432?v=4)](https://github.com/tburry "tburry (55 commits)")[![DaazKu](https://avatars.githubusercontent.com/u/2412909?v=4)](https://github.com/DaazKu "DaazKu (14 commits)")[![initvector](https://avatars.githubusercontent.com/u/1390241?v=4)](https://github.com/initvector "initvector (12 commits)")[![acharron-hl](https://avatars.githubusercontent.com/u/146114816?v=4)](https://github.com/acharron-hl "acharron-hl (3 commits)")[![linc](https://avatars.githubusercontent.com/u/117672?v=4)](https://github.com/linc "linc (3 commits)")[![charrondev](https://avatars.githubusercontent.com/u/1770056?v=4)](https://github.com/charrondev "charrondev (1 commits)")[![bleistivt](https://avatars.githubusercontent.com/u/5205806?v=4)](https://github.com/bleistivt "bleistivt (1 commits)") --- Tags production ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/vanilla-htmlawed/health.svg) ``` [![Health](https://phpackages.com/badges/vanilla-htmlawed/health.svg)](https://phpackages.com/packages/vanilla-htmlawed) ``` ### Alternatives [webmozart/assert Assertions to validate method input/output with nice error messages. 7.6k894.0M1.2k](/packages/webmozart-assert)[bensampo/laravel-enum Simple, extensible and powerful enumeration implementation for Laravel. 2.0k15.9M104](/packages/bensampo-laravel-enum)[swaggest/json-schema High definition PHP structures with JSON-schema based validation 48612.5M73](/packages/swaggest-json-schema)[stevebauman/purify An HTML Purifier / Sanitizer for Laravel 5325.6M19](/packages/stevebauman-purify)[ashallendesign/laravel-config-validator A package for validating your Laravel app's config. 217905.3k5](/packages/ashallendesign-laravel-config-validator)[crazybooot/base64-validation Laravel validators for base64 encoded files 1341.9M8](/packages/crazybooot-base64-validation) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)