README

Rust-based HTML sanitizer for PHP — wraps the ammonia crate.

10-30x faster than HTMLPurifier with comparable security defaults.

Install via PIE

Requires PIE 1.4.0+:

pie install nicofff/ammonia

Usage

Quick sanitize (defaults)

use function Ammonia\sanitize_html;

$clean = sanitize_html('<p>Hello <script>alert("xss")</script> <b>world</b></p>');
// Output: <p>Hello  <b>world</b></p>

Builder API (custom configuration)

use Ammonia\Builder;

$clean = (new Builder())
    ->addTags(['custom-element'])
    ->rmTags(['img'])
    ->addGenericAttributes(['class', 'id'])
    ->addTagAttributes('a', ['href', 'target'])
    ->addAllowedClasses('div', ['container', 'wrapper'])
    ->stripComments(true)
    ->linkRel('noopener noreferrer')
    ->idPrefix('user-content-')
    ->clean($dirtyHtml);

Available Builder methods

All methods (except clean()) return $this for chaining.

IDE Support

PHP stubs for autocompletion and static analysis are attached to each GitHub release as ammonia.stubs.php. Compatible with PhpStorm, Intelephense (VS Code), PHPStan, and Psalm.

Building from source

cargo build --release
php -d extension=./target/release/libammonia_php_rs.dylib -r 'echo Ammonia\sanitize_html("<b>hi</b>");'

Running benchmarks

cd benchmark
composer install
cd ..
php -d extension=./target/release/libammonia_php_rs.dylib benchmark/benchmark.php