This package is abandoned and no longer maintained. The author suggests using the symfony/html-sanitizer package instead.

Sanitize untrustworthy HTML user input

Installs: 3 564 665

Dependents: 10

Suggesters: 0

Security: 0

Stars: 365

Watchers: 17

Forks: 41

Open Issues: 23

1.5.0 2021-09-14 08:27 UTC

This package is auto-updated.

Last update: 2022-06-24 11:57:36 UTC


This library is deprecated as it was merged into Symfony as the HtmlSanitizer component in Symfony 6.1:

Build Status Packagist Version Software license


html-sanitizer is a library aiming at handling, cleaning and sanitizing HTML sent by external users (who you cannot trust), allowing you to store it and display it safely. It has sensible defaults to provide a great developer experience while still being entirely configurable.

Internally, the sanitizer has a deep understanding of HTML: it parses the input and create a tree of DOMNode objects, which it uses to keep only the safe elements from the content. By using this technique, it is safe (it works with a strict whitelist), fast and easily extensible.

It also provides useful features such as the possibility to transform images or iframes URLs to HTTPS.

Symfony integration

This library is also available as a Symfony bundle.


  1. Getting started
  2. Creating an extension to allow custom tags
  3. Configuration reference
  4. Comparison with HTMLPurifier

Security Issues

If you discover a security vulnerability within the sanitizer, please follow our disclosure procedure.

Backward Compatibility promise

This library follows the same Backward Compatibility promise as the Symfony framework:

Note: many classes in this library are either marked @final or @internal. @internal classes are excluded from any Backward Compatiblity promise (you should not use them in your code) whereas @final classes can be used but should not be extended (use composition instead).


Many thanks to: