README

Sanigen provides declarative sanitization and attribute generators for Eloquent models, so teams can keep input cleanup consistent without repeating pipelines across models.

Quick Start

composer require ivanbaric/sanigen

Recommended: publish the config file.

php artisan vendor:publish --provider="IvanBaric\Sanigen\SanigenServiceProvider" --tag="config"

Define aliases in config/sanigen.php, then reuse the same defaults across your models.

'aliases' => [
    'text' => 'strip_html|strip_scripts|strip_emoji|strip_newlines|trim|squish',
    'title' => 'strip_html|strip_scripts|strip_emoji|strip_newlines|trim|squish|lower|ucfirst',
    'ascii' => 'strip_html|strip_scripts|strip_emoji|strip_newlines|trim|squish|ascii',
    'email' => 'trim|lower|email',
    'url' => 'trim|strip_newlines|strip_scripts|url',
    'slug' => 'trim|lower|slug',
    'decimal' => 'trim|decimal',
    'phone' => 'trim|phone_clean',
];

Sanigen gives you two model properties:

• $sanitize: applies sanitizer aliases from config/sanigen.php
• $generate: fills empty attributes on creating using generator rules

use Illuminate\Database\Eloquent\Model;
use IvanBaric\Sanigen\Traits\Sanigen;

class Post extends Model
{
    use Sanigen;

    protected $fillable = ['name', 'description', 'email', 'website', 'slug', 'price', 'phone'];

    protected array $sanitize = [
        'name' => 'title',
        'description' => 'text',
        'email' => 'email',
        'website' => 'url',
        'slug' => 'slug',
        'price' => 'decimal',
        'phone' => 'phone',
    ];

    protected array $generate = [
        'slug' => 'slugify:name',
        'uuid' => 'uuid',
        'owner_id' => 'user:id',
        'team_id' => 'user:current_team_id',
    ];
}

$post = Post::create([
    'name' => '  <script>alert(1)</script>my FIRST post  ',
    'description' => '<script>alert(1)</script><p>Hello <strong>world</strong></p>',
    'email' => ' USER@EXAMPLE.COM ',
    'website' => 'example.com',
    'price' => ' EUR 1,234.56 ',
    'phone' => ' +1 (123) 456-7890 ',
]);

Result:

[
    'uuid' => '550e8400-e29b-41d4-a716-446655440000',
    'owner_id' => 1,
    'team_id' => 42,
    'name' => 'My first post',
    'description' => 'Hello world',
    'email' => 'user@example.com',
    'website' => 'https://example.com',
    'slug' => 'my-first-post',
    'price' => '1234.56',
    'phone' => '+11234567890',
]

Available Aliases

• text: generic cleaned text
• title: cleaned title-style text
• ascii: cleaned ASCII-only text
• email: normalized email
• url: normalized URL
• slug: slug-ready value
• decimal: normalized decimal number
• phone: normalized phone number

Class-Level Attributes

Besides model properties, you can use class-level attributes:

use IvanBaric\Sanigen\Attributes\Generate;
use IvanBaric\Sanigen\Attributes\Sanitize;

#[Sanitize([
    'name' => 'title',
    'description' => 'text',
    'email' => 'email',
])]
#[Generate([
    'slug' => 'slugify:name',
    'uuid' => 'uuid',
])]
class Post extends Model
{
    use Sanigen;
}

Rule priority is:

1. explicit model properties ($sanitize, $generate)
2. class-level attributes (#[Sanitize], #[Generate])
3. config defaults (sanitize_defaults, generate_defaults)

Full Reference

php artisan make:sanitizer Username
php artisan make:sanitizer Admin/TitleClean --force

namespace App\Sanitizers;

use IvanBaric\Sanigen\Sanitizers\Contracts\Sanitizer;

class UsernameSanitizer implements Sanitizer
{
    public function apply(string $value): string
    {
        return strtolower(trim($value));
    }
}

use IvanBaric\Sanigen\Registries\SanitizerRegistry;

SanitizerRegistry::register('username', \App\Sanitizers\UsernameSanitizer::class);

protected $sanitize = [
    'username' => 'username',
];

php artisan make:generator Slug
php artisan make:generator Content/Slug --force

namespace App\Generators;

use IvanBaric\Sanigen\Generators\Contracts\GeneratorContract;

class CouponCodeGenerator implements GeneratorContract
{
    public function generate(string $field, object $model): mixed
    {
        return 'SALE-' . strtoupper(str()->random(8));
    }
}

use IvanBaric\Sanigen\Registries\GeneratorRegistry;

GeneratorRegistry::register('coupon_code', \App\Generators\CouponCodeGenerator::class);

protected $generate = [
    'code' => 'coupon_code',
];

Resanitize Existing Rows

Warning: this command updates existing database records. Run it on a backup-aware deployment path and test it on staging first.

php artisan sanigen:resanitize "App\Models\Post" --chunk=200

Production Notes

return [
    'enabled' => true,
    'missing_sanitizer' => 'throw',
    'aliases' => [
        'text' => 'strip_html|strip_scripts|strip_emoji|strip_newlines|trim|squish',
        'title' => 'strip_html|strip_scripts|strip_emoji|strip_newlines|trim|squish|lower|ucfirst',
        'ascii' => 'strip_html|strip_scripts|strip_emoji|strip_newlines|trim|squish|ascii',
        'email' => 'trim|lower|email',
        'url' => 'trim|strip_newlines|strip_scripts|url',
        'slug' => 'trim|lower|slug',
        'decimal' => 'trim|decimal',
        'phone' => 'trim|phone_clean',
    ],
    'allowed_html_tags' => '<p><strong><em><a><ul><ol><li><br>',
    'encoding' => 'UTF-8',
    'max_strip_scripts_input_length' => 32768,
    'sanitize_defaults' => [],
    'generate_defaults' => [],
];

Spatie Translatable Support

Sanigen works with Spatie Laravel Translatable because translatable attributes are stored as arrays and Sanigen sanitizes each scalar item individually.

Limitations

Sanigen only runs when data goes through an Eloquent model instance.

Tests

composer test

License

MIT. See LICENSE.md.