htmlpurifierPHP filtering library

require_once '/path/to/HTMLPurifier.auto.php';

According to ThinkPHP specifications, for third-party extensions that do not comply with ThinkPHP development specifications, HTMLPurifier needs to be placed in the Library/Vendor directory middle. Then we can introduce HTMLPurifier.auto.php into the framework program through the following method:

vendor('htmlpurifier.library.HTMLPurifier#auto');

However, I am using ThinkPHP 3.2.1 here and found that this method can only be used in functions. This introduction into the controller class cannot be correctly recognized. In other words, we can only reference it in the common/function.php file.

Create HTMLPurifier object and implement rich text filtering

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($dirty_html);

How to configure the HTMLPurifier filter

To use HTMLPurifier, the focus is still on how to configure it. For the above program, we created a default configuration object through the createDefault() method. If we want to modify the configuration, we can use the set method to configure the settings. The method is as follows:

$config->set('config_object', value, a=null);

The first parameter is the attribute that needs to be configured, the second parameter is the value of the attribute, and the third parameter is specific I haven't figured out what it is used for, but I generally haven't used it. I will study it slowly when I have time.

HTMLPurifier's configuration attributes can be queried through its website

Configuration attribute selection

HTMLPurifier's configuration documents are mainly two-level classifications, and the major categories are Attr (attribute), HTML (html tag), AutoFormat (automatic format), CSS (css configuration), Output (output configuration)... Subcategory selection can be completed by adding the name of the major category. Adding the name of the subcategory.

For example, if I want to configure allowed html tags, such as p tag and a tag, I can configure it as follows

$config->set('HTML.Allowed', 'p,a');

Selection of attribute values

In the official document, click one After the attribute, you can see the explanation of this attribute. It will tell you that the value type (Type) of this attribute is String, Int, Array, Boolen...

Then it will also tell you the default value of this attribute. , such as NULL, true, false, etc. The format of this value is the same as PHP's format.

Whitelist filtering mechanism

HTMLPurifier uses a whitelist filtering mechanism, and only those that are allowed will pass the test.

Basic filtering example

a. Filter out all html tags in the text

/**
 * 过滤掉所有html标签很简单，原因则在白名单机制完成
 */
$config->set('HTML.Allowed', '');

b. Keep the hyperlink tag a and its href link address attribute, and automatically add target The attribute value is '_blank'

$config->set('HTML.Allowed', 'a[href]');
$config->set('HTML.TargetBlank', true);

c, automatically complete the paragraph code and clear out useless empty tags

// 让文本自动添加段落标签，前提是必须允许P标签的使用
$config->set('HTML.Allowed', 'p');
$config->set('AutoFormat.AutoParagraph', true);
// 清除空标签
$config->set('AutoFormat.RemoveEmpty', true);
……