Filter HTML - Nullai Documentation

The \Nullai\Hygiene\SanitizeHtml::filterTags() method is a powerful tool for sanitizing HTML content by allowing or blacklisting specific HTML tags and their attributes. This feature is particularly useful for ensuring secure and clean user-generated content.

Method Signature

\Nullai\Hygiene\SanitizeHtml::filterTags(string $html, string $tags, bool $allow): string

string

The HTML string to sanitize.

string

A comma-separated list of tags and attributes to allow or blacklist.

Attributes can be specified for a tag using :. For example, a:href|class allows the href and class attributes for <a> tags.
Tags without attributes apply rules to the entire tag. For instance, p targets the <p> tag.

boolean

Specifies the mode of filtering.

true: Whitelist mode — allows only the specified tags and attributes.
false: Blacklist mode — removes the specified tags and attributes.

Examples

1. Whitelisting Specific Tags and Attributes

Allow only the <p> and <a> tags, preserving the href and class attributes for <a>. All other tags and attributes will be removed.

<?php
echo \Nullai\Hygiene\SanitizeHtml::filterTags(
    html: '<p class="bold"><a href="#" class="underline">Link</a></p><div>Other Content</div>',
    tags: 'a:href|class,p',
    allow: true
);

// Output: <p><a href="#" class="underline">Link</a></p>

2. Blacklisting Specific Tags

Remove <iframe> and <script> tags from the input HTML while leaving other tags intact.

<?php
echo \Nullai\Hygiene\SanitizeHtml::filterTags(
    html: '<iframe><iframe><script>alert(true)<script><p>Safe Content</p>',
    tags: 'iframe,script',
    allow: false
);

// Output: <p>Safe Content</p>

Common Use Cases

Content Management Systems (CMS): Allow safe tags (e.g., <p>, <strong>) for user-submitted content.
Preventing Cross-Site Scripting (XSS): Blacklist potentially dangerous tags such as <script> or <iframe>.
Custom HTML Filtering: Enforce specific rules for HTML output tailored to your requirements.

Best Practices

Use Whitelisting: Prioritize whitelisting tags and attributes to ensure security by default.
Minimize Attributes: Allow only the essential attributes for each tag to reduce risks.
Test Thoroughly: Regularly test the output for edge cases and unusual input to ensure the desired behavior.

With \Nullai\Hygiene\SanitizeHtml::filterTags(), you can easily implement secure and customizable HTML sanitization in your applications.

​Method Signature

​Examples

​1. Whitelisting Specific Tags and Attributes

​2. Blacklisting Specific Tags

​Common Use Cases

​Best Practices