Joomla Filter

Joomla Filter is a standalone package from the Joomla Framework for cleaning untrusted data. Its InputFilter sanitizes and type-casts incoming values, stripping dangerous HTML, attributes, and protocols according to configurable allow/deny lists so user input is safe to store and use.

A companion OutputFilter prepares strings for safe output, including making text URL-safe and escaping content for display. Together they give PHP applications a small, dependency-light toolkit for defending against XSS and malformed input, usable inside Joomla or entirely on their own.

What You Get

• An InputFilter class for sanitizing and type-casting untrusted input
• Configurable tag and attribute allow/deny lists plus blocked protocols
• Named filter types (INT, UINT, FLOAT, BOOLEAN, WORD, STRING, HTML, and more) for clean()
• An OutputFilter for URL-safe string generation and output escaping
• A small footprint with only joomla/string as a required dependency
• Optional joomla/language integration for transliterated URL-safe strings

Common Use Cases

• Sanitizing form and request data before persistence
• Stripping unsafe HTML and attributes from rich-text input
• Type-casting request parameters to integers, floats, or clean strings
• Generating URL-safe slugs from titles for routing

Under The Hood

Architecture - The package is two classes under Joomla\Filter. InputFilter holds allow/deny lists for tags and attributes, a set of blocked protocols, and a filter-type dispatcher; clean($source, $type) routes to a per-type routine (numeric casts, word/alnum stripping, or the internal HTML cleaner that walks and rebuilds markup against the policy). OutputFilter provides static helpers for output-side transformations such as stringURLSafe, optionally using joomla/language for transliteration.

Tech Stack - Pure PHP 8.1+ depending only on joomla/string at runtime, with joomla/language as an optional suggestion. Development uses PHPUnit, PHP_CodeSniffer, and PHPStan (with a baseline), and CI runs via GitHub Actions.

Code Quality - Both classes have dedicated PHPUnit test files with stub fixtures, and the repo enforces coding standards (ruleset.xml) and static analysis (phpstan.neon + baseline). The small surface area keeps the code readable and the HTML-cleaning logic well-contained.

API Design - The API is intentionally tiny: construct an InputFilter (optionally with custom lists) and call clean() with a type constant, or call OutputFilter statics. This makes it approachable, though the security-relevant defaults and type semantics are best understood by reading the docs before relying on them for XSS defense.