HTML Purifier VS class-validator

HTML Purifier

On the homepage of http://htmlpurifier.org the last update is of december 2021. I didn’t think of checking GitHub. Thanks for the info!

For HTML specifically, HTMLPurifier is pretty well known.

There are several third party PHP libraries which are commonly used to assist in XSS prevention. Examples👇 HTML Purifier – here PHP Anti-XSS – here htmLawed – here

You need to filter the received HTML code and remove the tags and attributes you don't allow. The easiest way to do this is to use htmlpurifier. Otherwise you have to manually cleanup the HTML by using strip_tags and maybe some xml parsing (or regex) to remove unwanted attributes.

Or HTMLPurifier.

Definitely, its one of the best http://htmlpurifier.org/

Popular Packages & Tools - The League of Extraordinary Packages - Twig Templating engine - PHP Mailer - SwiftMailer - Flysystem file storage - PHPUnit testing - HTML Purifier

Check out this lib: http://htmlpurifier.org/. It is widely used in the PHP World.

You can learn more from the documentation here.

This is the request body when creating a new task. The IsString decorator provided by class-validator rejects all types other than strings, including undefined or null. The task name value object does not consider the possibility of values other than strings.

In this class, we are using the famous class-validator to decorate our request parameters. This way it is more clear how we are going to use our request object and everything.

We add validation using https://github.com/typestack/class-validator.

I will make sure we get this documented.

Also OP can check out class-transformer + class-validator if he want to properly instantiate objects and validate them with precise and verbose output of potential format errors. OP can even go the god tier way by setting up a custom RxJS operator that does that for him easily.

Start by installing the class-transformer and class-validator packages for dto validation (see more in the docs), sharp for image optimization, and the S3 client packages.

The description of the request body model in NestJS is similar to the description of Ditsmod models, but NestJS uses decorators provided by the utility class-validator. In NestJS, it is customary to name the request body model with the ending *Dto (this is an abbreviation of Data transfer object):

You could use Zod or Superstruct to validate the types of values, or use typestack/class-validator if it makes sense.

Also, title of before article was I made 1,000x faster TypeScript validator library, but today's benchmark is showing that typescript-json is maximum 6,500x times faster. It's just because I added a new library class-validator in the benchmark and it is much slower than previous zod. Of course, I've continuously tuned the performance, but it just improved the performance about 2x times only.