The current version of HTML Purifier is
4.13.0, released on
2020-06-28, and is tested with
PHP 5.3 and up (all code is E_STRICT
compliant). This library is open-source,
licensed under the LGPL
v2.1+. We offer multiple ways of downloading
and installing HTML Purifier. You might also be interested
in the Objective C port.
Table of Contents
Standard
We offer the standard zip and tarball downloads. Download them, unzip them, and with a few simple installation steps get to using HTML Purifier right away:
Lite Distribution
No, it's not magically faster. HTML Purifier Lite offers the same
functionality of HTML Purifier (standard), except that anything not
essentially to the basic functioning of the library has been stripped
out: end-user documentation, unit-tests, profiling, maintenance scripts, etc.
Just the library
folder.
Standalone Distribution
For those of you who balk at the possibility of a 100+ includes, we also
offer a conveniently packaged single-file version of HTML Purifier. Well,
not really, since HTML Purifier does require some auxiliary files in
order to work (but they are neatly tucked away in a folder named
standalone
). Include HTMLPurifier.standalone.php
and be done with it!
SHA-1 checksums
Here are the SHA-1 checksums you can use to verify the integrity of your HTML Purifier download:
888244cbbf03d8bbab13572a9c1a031889ebc29a htmlpurifier-4.13.0-lite.tar.gz 579a7d9662521a0c21fde5aa8491e526bf4e3e2e htmlpurifier-4.13.0-lite.zip 3e1900386f064d16f05d25a063f640c65fefe6cc htmlpurifier-4.13.0-standalone.tar.gz 72ff3fc1215a6b48ce4cfff6d4305e7e5cb9f095 htmlpurifier-4.13.0-standalone.zip ddbbc2cacb886730d5b3efcd896524f71fdd7a1a htmlpurifier-4.13.0.tar.gz 8843ba3db6fdec37d5f1c60b94cca04a60931b96 htmlpurifier-4.13.0.zip
GnuPG signatures
There are .sig files which you can use to cryptographically verify that the release is from me, Edward Z. Yang. You can find my public key here (0x869C48DA). My key's fingerprint is: 3FA8 E9A9 7385 B691 A6FC B3CB A933 BE7D 869C 48DA.
Verify files with this command:
gpg --verify $filename.sig
Future releases will be signed with my new ezyang@mit.edu key. This key is signed by my old key, and you can retrieve the signature from pgp.mit.edu.
PEAR
HTML Purifier is also available via a PEAR channel. The PEAR installer is an incredibly powerful and robust way to install PHP packages, and does not have to be limited to packages found on pear.php.net. With PEAR, installing is as simple as these two commands in your shell:
pear channel-discover htmlpurifier.org pear install hp/HTMLPurifier
...and then following the installation instructions.
You can upgrade with:
pear upgrade hp/HTMLPurifier
Composer
HTML Purifier is available via Composer, just run:
composer require ezyang/htmlpurifier
Git
For those who like to live on the edge, you can also grab the latest developmental code from our Git repository. Simply execute this command in your shell:
git clone git://repo.or.cz/htmlpurifier.git
You must have Git installed. Windows users can grab a copy of Git via the msysgit project.
Code in master is quite stable; a combination of extensive unit-testing and atomic commits means that the most recent version will almost never be broken.
Online repository browsing and mirroring services (click links to get pull URLs) are available at numerous places:
- repo.or.cz -
Master repository: prefer pulling from it, always push to it. Make this your
origin
remote if it isn't already. Allows forks, please use them! - Gitorious - Regular old mirror. Allows forks, but don't use them.
- GitHub - Regular old mirror, but with pretty history visualization tools. Allows forks, but don't use them.
Installation
File permissions
HTML Purifier will write
out cache files for HTMLDefinition in the subdirectories of
HTMLPurifier/DefinitionCache/Serializer
. If you are in
the library/
folder of HTML Purifier, you can set the
appropriate permissions using:
chmod -R 0755 HTMLPurifier/DefinitionCache/Serializer
If the above command doesn't work, you may need to assign write permissions to all. This may be necessary if your webserver runs as nobody, but is not recommended since it means any other user can write files in the directory. Use:
chmod -R 0777 HTMLPurifier/DefinitionCache/Serializer
You can also chmod files via your FTP client; this option is usually accessible by right clicking the corresponding directory and then selecting “chmod” or “file permissions”.
If you are unable or unwilling to give write permissions to the cache directory, you can either disable the cache (and suffer a performance hit):
$config->set('Core', 'DefinitionCache', null);
Or move the cache directory somewhere else (no trailing slash):
$config->set('Cache', 'SerializerPath', '/home/user/absolute/path');
Quick install
If your website is in UTF-8 and XHTML Transitional, use this code:
<?php require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php'; $purifier = new HTMLPurifier(); $clean_html = $purifier->purify($dirty_html); ?>
If your website is in a different encoding or doctype, use this code:
<?php require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php'; $config = HTMLPurifier_Config::createDefault(); $config->set('Core', 'Encoding', 'ISO-8859-1'); // replace with your encoding $config->set('HTML', 'Doctype', 'HTML 4.01 Transitional'); // replace with your doctype $purifier = new HTMLPurifier($config); $clean_html = $purifier->purify($dirty_html); ?>
People with HTML Purifier already in their path (PEAR, for example) can use:
require_once 'HTMLPurifier.auto.php';
For detailed installation instructions, read the
INSTALL
document.
Mailing list
You can be notified of new releases by a low-traffic announce list. Subscribe at the mailman page. We take your privacy very seriously and will not use emails submitted to this web form for any other purposes.
You can also subscribe to a moderately higher traffic, unmoderated mailing list intended for development discussion and user support at Google Groups.
History
Previous releases can be obtained by browsing the release directory or checking code out of the tags/ directory. However, they are not supported and should not be used in live environments. If you are having trouble upgrading, pop over to the forums and get help.