MarkupHTMLPurifier

purify($html)

Purify the given HTML string and return sanitized HTML.

$dirty = '<p onclick="alert(\'xss\')">Hello</p>';
$clean = $purifier->purify($dirty); // <p>Hello</p>

set($key, $value)

Set an HTML Purifier configuration option or a WireData property.

If $key contains a dot, it is forwarded to HTML Purifier's config. Any other key is stored as a regular WireData property. Changing an HTML Purifier setting clears the cached purifier instance so the new value takes effect on the next purify() call.

$purifier->set('HTML.Allowed', 'p,b,a[href]');
$purifier->set('AutoFormat.AutoParagraph', true);
$purifier->set('Core.Encoding', 'ISO-8859-1');

get($key)

Get an HTML Purifier configuration option or a WireData property.

If $key contains a dot, the value is read from HTML Purifier's config; otherwise the parent WireData get() behavior is used.

$encoding = $purifier->get('Core.Encoding');

getConfig()

Return the underlying HTMLPurifier_Config instance.

$config = $purifier->getConfig();
$config->set('HTML.Allowed', 'p,b,strong,em,i');

| Returns | \HTMLPurifier_Config |

getDef()

Return the raw HTML definition object (HTMLPurifier_HTMLDefinition) used to register custom elements and attributes. This is only available after init() has run, which happens automatically when the module is loaded.

$def = $purifier->getDef();
if($def) {
    $def->addAttribute('a', 'data-ext', 'Text');
}

| Returns | \HTMLPurifier_HTMLDefinition|null |

getPurifier()

Return the cached HTMLPurifier instance, creating it on first call.

$htmlpurifier = $purifier->getPurifier();
$clean = $htmlpurifier->purify($html);

| Returns | \HTMLPurifier |

clearCache()

Remove all cached HTML Purifier serializer files.

$purifier->clearCache();

| Returns | void |

MarkupHTMLPurifier extends WireData and inherits its hooks. The following hook is commonly used to customize the HTML Purifier configuration.

$wire->addHookAfter('MarkupHTMLPurifier::initConfig', function(HookEvent $event) {
    $settings = $event->arguments(0); /** @var \HTMLPurifier_Config $settings */
    $def = $event->arguments(1); /** @var \HTMLPurifier_HTMLDefinition $def */
    $def->addAttribute('a', 'data-download', 'Text');
});

• Access the module through $modules->get('MarkupHTMLPurifier').
• For the full list of HTML Purifier configuration options, see htmlpurifier.org/live/configdoc/plain.html.
• The module defaults to UTF-8 encoding, allows nofollow, noopener, and noreferrer in rel attributes, and registers <figure> and <figcaption> elements.
• Extends WireData and implements Module.
• Source file: wire/modules/Markup/MarkupHTMLPurifier/MarkupHTMLPurifier.module