# ezyang/htmlpurifier

Standards compliant HTML filter written in PHP

Repository: https://github.com/ezyang/htmlpurifier
Canonical: https://ross.abutalabs.com/products/htmlpurifier
Homepage: http://htmlpurifier.org
Language: PHP
License: LGPL-2.1
License Family: copyleft
Last push: 2026-08-12T04:45:48+00:00

## Health v2 (maintenance only)
Score: 71/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 97, release rhythm 20, longevity 100
- inputs: {"age_days": 6644, "days_push": 21, "days_rel": 320, "gap_med": 350, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3349, forks 359 (observed 2026-08-28T04:07:57.799684+00:00)

## What it is
HTML Purifier is a PHP library that filters HTML input using whitelists and aggressive parsing to remove XSS attacks while producing standards-compliant HTML. It is designed for sanitizing richly formatted documents from untrusted sources.

## Use cases
- sanitize user-submitted html to prevent xss
- filter rich text from wysiwyg editors like tinymce
- clean untrusted html while preserving css and formatting
- make user html standards compliant
- allow a restricted whitelist of html tags in comments

## When to choose
- you need to accept richly formatted html from untrusted users
- standards-compliant output matters as much as security
- you need fine-grained whitelist configuration for tags and css

## When to avoid
- you only need to strip all html and escape plain text
- performance is critical and a bare-bones sanitizer suffices
- your project is not written in php

## Facets
- artifact type: library
- maturity: maintenance
- function: security, parser, templating
- domain: security, web-development, backend
- platform: php
- tags: html-filtering, xss-protection, html-sanitization, whitelist, web-server

## Member repositories
- ezyang/htmlpurifier (main) score 71

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:57.799684+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:40:59.025929+00:00, confidence not recorded.
  - readme: https://github.com/ezyang/htmlpurifier (fetched 2026-08-28T04:07:57.799684+00:00, sha b27302f5e4c6)
- Data as of 2026-08-30T08:39:29.467469+00:00.