HTMLawed

htmLawed is a PHP script that filters and sanitizes HTML, XHTML, or XML text so it is safer and more standards-compliant. It neutralizes cross-site scripting (XSS) vectors, balances and properly nests tags, restricts which elements, attributes, and URL protocols are allowed, and can beautify or compact markup — all from a single dependency-free PHP file that works even on older PHP runtimes.

It is commonly used to filter user-submitted HTML such as blog comments and forum posts, to clean excerpts pulled into RSS feeds so they remain XML-compliant, and to scrub scraped web content before reuse. Configuration is driven by a $config array and an optional $spec array, giving fine-grained control over which tags, attributes, and schemes survive the filter, making it a lightweight alternative to heavier tools like HTML Tidy or HTMLPurifier.

What You Get

• A single htmLawed() function you call directly — no build step, no autoloader tricks beyond a Composer files autoload of one PHP file
• XSS neutralization: strips or defuses <script> tags, on* event handlers, javascript:/data: URLs, and other injection vectors when the safe option is set
• Tag balancing and proper nesting so malformed input becomes well-formed HTML or XML
• Fine-grained element and attribute allow/deny lists via the elements, deny_attribute, and schemes configuration keys
• HTML beautification/compaction, deprecated element/attribute transformation (e.g. <font> to CSS), and character-entity normalization
• Works unmodified from PHP 4.4 through modern PHP versions, per the library’s own compatibility claim and CI matrix

Common Use Cases

• Filtering HTML submitted through blog comments or forum posts before storing or rendering it
• Cleaning excerpts pulled into RSS/Atom feeds so they remain valid XML
• Sanitizing scraped HTML from third-party pages before reuse or display
• Pretty-printing or compacting HTML output for readability or bandwidth
• Enforcing a restricted subset of tags/attributes for a CMS’s rich-text editor output

Under The Hood

Architecture htmLawed is a single procedural PHP file (htmLawed.php) built around one entry point, htmLawed($t, $C, $S), which normalizes the $config array and then pipes the input string through a fixed sequence of alphabetically-named helper functions (hl_tag, hl_balance, hl_attributeValue, hl_entity, hl_url, hl_deprecatedElement, hl_tidy, and others). There is no class hierarchy, no dependency injection, and no plugin system beyond a single caller-supplied hook function for tag content; every helper mutates and returns plain strings and arrays, so the entire transformation is one linear pass with well-defined internal stages (character/entity cleanup, tag balancing, per-attribute filtering, then optional tidying). Because everything lives in module-level functions rather than encapsulated objects, the main risk of core-abstraction change is high coupling to string-format conventions passed between stages, but it also makes the code trivial to vendor as a single file.

Tech Stack The library targets plain PHP with composer.json declaring only "php": ">=4.4" as a requirement, no runtime dependencies, and a Composer files autoload entry that simply requires htmLawed.php. Testing infrastructure is PHPUnit-based (phpunit.xml.dist runs .phpt files from tests/), and CI (.github/workflows/main.yml) matrixes PHP 7.0 through 8.2 plus latest, running php -l syntax checks and composer validate on every push. There is no build step, transpiler, or bundler — the deployable artifact is the PHP source itself.

Code Quality Automated test coverage is minimal: the repository ships one PHPUnit .phpt case (tests/example.phpt, an XSS smoke test) alongside a much larger manual/browser-based harness (htmLawedTest.php) intended for interactive testing rather than CI assertions. There are no PHP type declarations (the codebase predates PHP 7 scalar type hints and still supports PHP 4.4), no static analysis or linter configuration beyond php -l syntax checks in CI, and error handling relies on PHP’s native warnings rather than exceptions. Naming is consistent (hl_* prefix for internal helpers) and the main function has an in-file docblock describing parameters, but the single 1,600-line file with dense regex and array-manipulation logic would benefit from further decomposition and typed signatures.

What Makes It Unique Unlike heavier alternatives such as HTMLPurifier, htmLawed’s distinguishing choice is radical minimalism: one dependency-free file, compatible back to PHP 4.4, with no external DOM/XML extension requirement, making it usable in constrained legacy hosting environments where installing a full purifier library is impractical. Its configuration model — compact string grammars like elements="*-script-object" for allow/deny lists and a schemes mini-language for per-attribute URL protocol control — trades verbosity for a terse, code-golf-like API that longtime users can express complex policies in a single line, though this comes at some cost to readability for newcomers.