Sanitizer

MMO\editor\cms · 1 symbol · generated 27 Oct 2026

class

Sanitizer

Clean html on the server so that it only holds what <mmo-editor> produces: the same rules as MMO.editor.sanitize() (src/js/editor.js), which the browser applies first. What a client sends is never trusted for that -- a request can be written by hand -- so every "format": "html" field goes through here before it is saved (Pages::saveDraft).

class MMO\editor\cms\Sanitizer

Namespace: MMO\editor\cms

- The tags of [`ALLOWED_TAGS`](https://mmoframework.fr/en/documentation/mmo.editor/php/cms/Sanitizer.md#sanitizer-allowed-tags) stay, with only their attributes listed there; another tag is replaced by its content, but those of [`DROPPED_TAGS`](https://mmoframework.fr/en/documentation/mmo.editor/php/cms/Sanitizer.md#sanitizer-dropped-tags), which go with it (a script, a style, an embedded document...). - `href` and `src` keep only `http(s)`, `mailto`, `tel` and relative urls (`src`: also an image's `data:`). - `style` keeps only `ALLOWED_STYLES`: alignments, an image's width, and colours that are design tokens. - A `target` is `_blank` or nothing, and gets `rel="noopener noreferrer"`.

(new Sanitizer())->sanitize('<p onclick="x()">Hi <script>a()</script><a href="javascript:x">there</a></p>'); // '<p>Hi there</p>'

Index

	ALLOWED_TAGS
	BLOCK_TAGS	the tags of a block of text: inside an inline field, one becomes a space
	DROPPED_TAGS	the tags removed with everything they hold (`MMO.editor.DROPPED_TAGS`)
	EMPTY_DROPPED_TAGS	the tags removed when they hold nothing at all
	INLINE_TAGS	what an inline field (a title, a caption: `"editor": "inline"`) keeps: text formatting only
	RENAMED_TAGS	the tags a word processor gives under another name: kept as the editor's own
	TOKEN_COLOR	a colour kept: a design token only, which follows the theme and its dark mode
	cleanAttributes($element)	Keep the attributes `ALLOWED_TAGS` lists for $element, with safe values only
	cleanChildren($node, $inline)
	cleanStyle($style)
	isAllowedStyle($property, $value)
	IsSafeUrl($url, $image) static
	rename($element, $tag)
	sanitize($html, $inline)
	unwrap($element)	Replace $element by its children

Constants7

ALLOWED_TAGS

const ALLOWED_TAGS = […36 items]

BLOCK_TAGS

the tags of a block of text: inside an inline field, one becomes a space

const BLOCK_TAGS = […17 items]

DROPPED_TAGS

the tags removed with everything they hold (MMO.editor.DROPPED_TAGS)

const DROPPED_TAGS = […21 items]

EMPTY_DROPPED_TAGS

the tags removed when they hold nothing at all

const EMPTY_DROPPED_TAGS = […21 items]

INLINE_TAGS

what an inline field (a title, a caption: "editor": "inline") keeps: text formatting only

const INLINE_TAGS = […15 items]

RENAMED_TAGS

the tags a word processor gives under another name: kept as the editor's own

const RENAMED_TAGS = ['strong' => 'b', 'em' => 'i', 'strike' => 's', 'del' => 's']

TOKEN_COLOR

a colour kept: a design token only, which follows the theme and its dark mode

const TOKEN_COLOR = '/^var\$--mmo-color-[a-z0-9-]+\$$/'

Methods8

cleanAttributes($element)

Sanitizer.php:125

Keep the attributes ALLOWED_TAGS lists for $element, with safe values only

protected function cleanAttributes(DOMElement $element): void

$element	DOMElement
returns	void

cleanChildren($node, $inline)

Sanitizer.php:87

protected function cleanChildren(DOMNode $node, bool $inline): void

$node	DOMNode
$inline	bool
returns	void

cleanStyle($style)

Sanitizer.php:166

protected function cleanStyle(string $style): string

$style	string
returns	string	the declarations of $style that `ALLOWED_STYLES` keeps, `prop: value;` each

isAllowedStyle($property, $value)

Sanitizer.php:178

protected function isAllowedStyle(string $property, string $value): bool

See: MMO.editor.ALLOWED_STYLES

$property	string
$value	string
returns	bool

IsSafeUrl($url, $image)

staticSanitizer.php:79

static function IsSafeUrl(string $url, bool $image = false): bool

$url	string
$image = false	bool	true for an `<img src>`, which may also be an image's `data:` url
returns	bool	false for `javascript:` and any scheme that is not a document's or an image's (`MMO.editor.isSafeUrl`)

rename($element, $tag)

Sanitizer.php:196

protected function rename(DOMElement $element, string $tag): DOMElement

$element	DOMElement
$tag	string
returns	DOMElement	$element, as a $tag holding its attributes and children

sanitize($html, $inline)

Sanitizer.php:55

function sanitize(string $html, bool $inline = false): string

$html	string
$inline = false	bool	true to keep text formatting only (`INLINE_TAGS`)
returns	string	the clean html

unwrap($element)

Sanitizer.php:188

Replace $element by its children

protected function unwrap(DOMElement $element): void

$element	DOMElement
returns	void