HTMLPurifier::purify PHP Method

purify() public method

Filters an HTML snippet/document to be XSS-free and standards-compliant.
public purify ( string $html, HTMLPurifier_Config $config = null ) : string
$html string String of HTML to purify
$config HTMLPurifier_Config Config object for this operation, if omitted, defaults to the config object specified during this object's construction. The parameter can also be any type that HTMLPurifier_Config::create() supports.
return string Purified HTML
    public function purify($html, $config = null)
    {
        // :TODO: make the config merge in, instead of replace
        $config = $config ? HTMLPurifier_Config::create($config) : $this->config;
        // implementation is partially environment dependant, partially
        // configuration dependant
        $lexer = HTMLPurifier_Lexer::create($config);
        $context = new HTMLPurifier_Context();
        // setup HTML generator
        $this->generator = new HTMLPurifier_Generator($config, $context);
        $context->register('Generator', $this->generator);
        // set up global context variables
        if ($config->get('Core.CollectErrors')) {
            // may get moved out if other facilities use it
            $language_factory = HTMLPurifier_LanguageFactory::instance();
            $language = $language_factory->create($config, $context);
            $context->register('Locale', $language);
            $error_collector = new HTMLPurifier_ErrorCollector($context);
            $context->register('ErrorCollector', $error_collector);
        }
        // setup id_accumulator context, necessary due to the fact that
        // AttrValidator can be called from many places
        $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
        $context->register('IDAccumulator', $id_accumulator);
        $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
        // setup filters
        $filter_flags = $config->getBatch('Filter');
        $custom_filters = $filter_flags['Custom'];
        unset($filter_flags['Custom']);
        $filters = array();
        foreach ($filter_flags as $filter => $flag) {
            if (!$flag) {
                continue;
            }
            if (strpos($filter, '.') !== false) {
                continue;
            }
            $class = "HTMLPurifier_Filter_{$filter}";
            $filters[] = new $class();
        }
        foreach ($custom_filters as $filter) {
            // maybe "HTMLPurifier_Filter_$filter", but be consistent with AutoFormat
            $filters[] = $filter;
        }
        $filters = array_merge($filters, $this->filters);
        // maybe prepare(), but later
        for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
            $html = $filters[$i]->preFilter($html, $config, $context);
        }
        // purified HTML
        $html = $this->generator->generateFromTokens($this->strategy->execute($lexer->tokenizeHTML($html, $config, $context), $config, $context));
        for ($i = $filter_size - 1; $i >= 0; $i--) {
            $html = $filters[$i]->postFilter($html, $config, $context);
        }
        $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
        $this->context =& $context;
        return $html;
    }

Usage Example

 function html_purify($dirty_html, $config = FALSE)
 {
     require_once APPPATH . 'third_party/htmlpurifier-4.6.0-standalone/HTMLPurifier.standalone.php';
     if (is_array($dirty_html)) {
         foreach ($dirty_html as $key => $val) {
             $clean_html[$key] = html_purify($val, $config);
         }
     } else {
         $ci =& get_instance();
         switch ($config) {
             //settings for rhe WYSIWYG
             case 'comment':
                 $config = HTMLPurifier_Config::createDefault();
                 $config->set('Core.Encoding', $ci->config->item('charset'));
                 $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
                 $config->set('HTML.Allowed', 'a[href|title],img[title|src|alt],em,strong,cite,blockquote,code,ul,ol,li,dl,dt,dd,p,br,h1,h2,h3,h4,h5,h6,span,*[style]');
                 $config->set('AutoFormat.AutoParagraph', TRUE);
                 $config->set('AutoFormat.Linkify', TRUE);
                 $config->set('AutoFormat.RemoveEmpty', TRUE);
                 break;
             case FALSE:
                 $config = HTMLPurifier_Config::createDefault();
                 $config->set('Core.Encoding', $ci->config->item('charset'));
                 $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
                 break;
             default:
                 show_error('The HTMLPurifier configuration labeled "' . htmlentities($config, ENT_QUOTES, 'UTF-8') . '" could not be found.');
         }
         $purifier = new HTMLPurifier($config);
         $clean_html = $purifier->purify($dirty_html);
     }
     return $clean_html;
 }
All Usage Examples Of HTMLPurifier::purify