pieceofcake2 / purifiable

v1.0.1 2026-10-16 08:35 UTC

Requires

• php: >=8.0
• composer/installers: ^1.0 || ^2.0
• ezyang/htmlpurifier: ^4.17
• pieceofcake2/cakephp: ^2.12

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^9.6
• pieceofcake2/app: ^2.2
• pieceofcake2/phpcs-cakephp2: ^1.1
• pieceofcake2/phpstan-cakephp2: ^1.0

Replaces

• josegonzalez/cakephp-purifiable: *

MIT

• Jose Diaz-Gonzalez

• cakephp
• htmlpurifier
• Behavior
• xss
• cakephp2
• purifiable

Published on Packagist.org on 2026-10-16 09:34 UTC

README

This is forked for CakePHP2.

A model behavior for pieceofcake2/cakephp applications that sanitizes HTML fields with HTML Purifier before they are saved: it removes malicious code (XSS) and keeps the allowed formatting.

Documentation

• Website: https://pieceofcake2.github.io/purifiable/ (日本語: https://pieceofcake2.github.io/purifiable/ja/)
• Markdown: docs/README.md (日本語: docs/ja/README.md) (for AI tools and offline reading)

It covers the settings, the HTML Purifier configuration, custom filters, the definition cache and the migration from josegonzalez/cakephp-purifiable.

The Markdown documentation is also included in the Composer package, in the plugin's directory: plugins/Purifiable/docs/README.md (the location depends on your installer-paths).

Requirements

• PHP 8.0+
• pieceofcake2/cakephp 2.12+
• ezyang/htmlpurifier 4.17+ (installed with the plugin)

Installation

composer require pieceofcake2/purifiable

Load the plugin in config/bootstrap.php (legacy layout: app/Config/bootstrap.php):

CakePlugin::load('Purifiable');

See Installation for the installer-paths setting.

Usage

class Post extends AppModel
{
    public $actsAs = [
        'Purifiable.Purifiable' => [
            'fields' => ['body'],
            'overwrite' => true,
        ],
    ];
}

body is purified when the post is saved. Without overwrite, the original value is kept and the purified HTML is saved to body_clean. See Settings.

Contributing

See the contribution guidelines.

Origin

This package is a maintained fork of josegonzalez/cakephp-purifiable (josegonzalez/cakephp-purifiable on Packagist, archived), originally by Jose Diaz-Gonzalez. It is maintained for CakePHP 2 on modern PHP by pieceofcake2. Changes from the original are listed in the commit history since the fork.

License

Licensed under the MIT License. See LICENSE.