HTML Purifier VS class-transformer

HTML Purifier

On the homepage of http://htmlpurifier.org the last update is of december 2021. I didn’t think of checking GitHub. Thanks for the info!

For HTML specifically, HTMLPurifier is pretty well known.

There are several third party PHP libraries which are commonly used to assist in XSS prevention. Examples👇 HTML Purifier – here PHP Anti-XSS – here htmLawed – here

You need to filter the received HTML code and remove the tags and attributes you don't allow. The easiest way to do this is to use htmlpurifier. Otherwise you have to manually cleanup the HTML by using strip_tags and maybe some xml parsing (or regex) to remove unwanted attributes.

Or HTMLPurifier.

Definitely, its one of the best http://htmlpurifier.org/

Popular Packages & Tools - The League of Extraordinary Packages - Twig Templating engine - PHP Mailer - SwiftMailer - Flysystem file storage - PHPUnit testing - HTML Purifier

Check out this lib: http://htmlpurifier.org/. It is widely used in the PHP World.

JSON serialization is 200x faster than class-transformer

Also OP can check out class-transformer + class-validator if he want to properly instantiate objects and validate them with precise and verbose output of potential format errors. OP can even go the god tier way by setting up a custom RxJS operator that does that for him easily.

Start by installing the class-transformer and class-validator packages for dto validation (see more in the docs), sharp for image optimization, and the S3 client packages.

And you can always transform the input in the DTO using class-transformer or use case insensitive when you search.

Anyone here using https://github.com/typestack/class-transformer and now seeing intermittent failures using either plainToClass or plainToInstance?

View on GitHub

My two cents: class-transformer it will require to use decorators in your code, but it can handle more cases