Purify

Purify is a Laravel package that wraps ezyang’s battle-tested HTMLPurifier library, providing an idiomatic Laravel API — a facade, config file, service provider, and Eloquent model casts — for stripping dangerous or unwanted markup from user-submitted HTML. It’s commonly used to sanitize rich-text editor output, comments, or any HTML field before storage or display, preventing XSS and malformed-markup issues.

Beyond a simple Purify::clean() call, the package supports named purification profiles/definitions for different trust levels of input, response caching of purified output for performance, and a dedicated Eloquent cast so a model attribute can be automatically sanitized on save without extra glue code in application logic.

What You Get

• A Purify facade for one-line HTML sanitization calls anywhere in a Laravel application
• Named purification profiles/definitions for applying different sanitization rules to different input types
• An Eloquent cast (Casts/) that automatically sanitizes a model attribute’s HTML on set
• Response caching of purified output to avoid re-running the sanitizer on unchanged content
• Artisan commands (Commands/) for cache management and configuration publishing

Common Use Cases

• Sanitizing rich-text editor (WYSIWYG) output before storing it in the database
• Cleaning user-submitted comments or forum posts to strip scripts and unsafe attributes
• Automatically purifying an Eloquent model’s HTML attribute on every save via a cast
• Applying different sanitization strictness levels for admin-authored vs. public user-submitted content

Under The Hood

Architecture: PurifyServiceProvider.php registers the package’s config, facade binding, and Artisan commands, while Purify.php/PurifyManager.php wrap calls to the underlying ezyang/htmlpurifier instance, translating Laravel config arrays into HTMLPurifier’s own configuration format; Definitions/ holds named purification-profile classes so different parts of an app can apply different allow-lists without duplicating configuration.

Tech Stack: Purify is a thin Laravel package (its own PHP surface is small) built entirely on top of ezyang/htmlpurifier for the actual sanitization logic, following the standard Composer + Laravel service-provider auto-discovery pattern, with a Cache/ module supporting Laravel’s cache stores for storing purified output.

Code Quality: The test suite is comparatively small (6 test files) relative to the number of configuration surfaces (definitions, casts, caching), so coverage leans toward integration-level checks of the facade and cast rather than exhaustive edge-case testing; CI runs a run-tests.yml workflow, but commit activity has slowed markedly (0 commits/month at time of analysis), typical for a small, feature-complete wrapper package.

API Design: The primary entry point, Purify::clean($html), requires no setup for default use, and the Eloquent cast (protected $casts = ['body' => Purify::class]) lets sanitization happen transparently on model save — both patterns match idioms Laravel developers already know, keeping the learning curve low despite HTMLPurifier’s own configuration being fairly deep underneath.