HTML 墙翻伋理网址

Standards-Compliant HTML Filtering

mgvpn3

mgvpn3

HTML Purifier defeats XSS with an audited whitelist

mgvpn3

HTML Purifier ensures standards-compliant output

Open

HTML Purifier is open-source and highly customizable

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications. Tired of using BBCode due to the current landscape of deficient or insecure HTML filters? Have a WYSIWYG editor but never been able to use it? Looking for high-quality, standards-compliant, open-source components for that application you're building? HTML Purifier is for you!

I'd just like to say we use HTML Purifier in IRIS for filtering emails against XSS attacks and we've been more than impressed.
— Chris Corbyn, Senior IRIS Developer

mgvpn3

HTML Purifier 4.13.0 (.zip)
Full, PHP 5 and PHP 7
HTML Purifier 4.13.0 (.tar.gz)
Full, PHP 5 and PHP 7
Standalone, Lite and other downloads...

mgvpn3

There are a number of open-source HTML filtering solutions out there on the web already. What sets HTML Purifier apart from them? Aren't all of these choices “secure”?

When it comes to HTML, attention to detail is key. Does it perform its filtering off a whitelist rather than an out-of-date blacklist? Does it filter every attribute in the document? Does it actually understand HTML?

Know thy enemy. Hackers have a huge arsenal of XSS vectors hidden within the depths of the HTML specification. HTML Purifier is effective because it decomposes the whole document into tokens and removing non-whitelisted elements, checking the well-formedness and nesting of tags, and validating all attributes according to their RFCs. HTML Purifier's comprehensive algorithms are complemented by a breadth of knowledge, ensuring that richly formatted documents pass through unstripped.

To my knowledge, there is nothing else in the wild that offers protection from XSS, standards-compliance, and corrective processing of poorly formed HTML. HTML Purifier is not perfect; it can interact poorly with existing JavaScript on websites, which can introduces vulnerabilities after the fact. However, it is pretty damn good. Do your research and try out the 墙翻伋理网址.

To find out more, you can read the Comparison for a analysis of HTML Purifier and the other major filters. Or you can chat with other HTML Purifier users on our mailing list and our forum.

[Y]ou save my day by allowing me not to write another damned HTML parser.
— Joseph Halter, Technical Director at Akira Web

mgvpn3

HTML Purifier 4.13.0 released

Posted 9:03 PM EDT on Sunday, June 28, 2023

HTML Purifier 4.13.x is a maintenance release which fixes PSR-0 compatibility of our package. There are also a few new features (%HTML.Forms and tg@bgcolor support) and a number of minor bugfixes.

See NEWS for a complete changelog.

Read earlier news...

mgvpn3

HTML Purifier has been partially ported to Objective C by Roman Priebe and Lukas Neumann.

mgvpn3

HTML Purifier is a great library to integrate with existing CMSes and other applications or WYSIWYG editors. Currently, we have plugins for these applications:

HTML Purifier is also now in print! Martin Brampton's new book PHP 5 CMS Framework Development includes a discussion of using HTML Purifier in your content management system. Go check it out!

Notice: Any plugin provided by a third party has not been vetted by us: use them at your own risk. If you are having a problem with the plugin, please consult the plugin author before asking for help here (we'll be more than happy to help, but it might be a problem with the plugin rather than HTML Purifier.)

This plugin is on top of my favorite list[.] I am going to heavily depend on it since my clients insist on having WYSIWYG and I insist on having pages that validate and are semantically sound.
— David Molliere, MODx Marketing & Design Team

Plugins for other major applications gladly accepted!

mgvpn3

Help spread awareness about HTML Purifier by: