HTML Purifier is a standards-compliant HTML filter library. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications.
HTML Purifier is very tasty when combined with WYSIWYG editors and is more comprehensive, standards-compliant, permissive and extensive than Drupal's built-in filtered HTML option, which uses a derivative of kses. You can read more about it at this comparison page. Want custom fonts, tables, inline styling, images, and more? Want just a restricted tag set but bullet-proof standards-compliant output? HTML Purifier is for you!
The HTML Purifier module is licensed under GPL v2 or later, however, the HTML Purifier library itself is licensed under LGPL v2.1 or later.
Want to give it a test drive? Try it out on simplytest.me.
- Place the htmlpurifier folder for this plugin in your drupal modules directory.
- Download HTML Purifier from http://htmlpurifier.org/
- If you have the libraries API installed, extract the resulting folder and place it inside your site/all/libraries folder as "htmlpurifier", so that site/all/libraries/htmlpurifier/library/HTMLPurifier.auto.php exists
- Otherwise, extract the "library" folder and place it inside your modules/htmlpurifier
directory, so that modules/htmlpurifier/library/HTMLPurifier.auto.php exists
- Go to Administer > Site building > Modules and enable this module
- You can now create a new input format or add the HTML Purifier to an existing input format. It is recommended that you place HTML Purifier as the last filter in the input format. Reorder the filters if necessary.
- You can customize filter options by going to Site Configuration > Input formats > configure
HTML Purifier v4.5.0+ & htmlpurifier.module 7.x-2.x
If you are using the latest 4.5.0 library version of HTML Purifier with the 2.x branch, make sure you use the Standard download. Alternatively, you can use the lite version but you must manually create a VERSION file in the root htmlpurifier library folder that lists the appropriate version of HTML Purifier.
- FCKEditor (D6 only) generates bogus numeric name attributes, to pass them through the filter use the configuration option HTML.Attr.Name.UseCDATA on the advanced configuration page.
- By default, external images are not allowed (this is how Filter HTML works too). You can enable external images by setting URI.DisableExternalResources off.
Comprehensive installation instructions can be found in the INSTALL.txt file.
HTML Purifier, WYSIWYG, and TinyMCE - shared at TriDUG by cgmonroe on 04/16/2013