home
/
zktecojo
/
public_html
/
htmlpurifier
/
configdoc
➕ New
📤 Upload
✎ Editing:
plain.html
← Back
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title> Configuration Documentation - HTML Purifier </title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="stylesheet" type="text/css" href="styles/plain.css" /> </head> <body> <div id="content"> <div id="library"> HTML Purifier </div> <h1> Configuration Documentation </h1> <div id="tocContainer"> <h2> Table of Contents </h2> <ul id="toc"> <li> <a href="#Attr">Attr</a> <ul> <li> <a href="#Attr.AllowedClasses">AllowedClasses</a> </li> <li> <a href="#Attr.AllowedFrameTargets">AllowedFrameTargets</a> </li> <li> <a href="#Attr.AllowedRel">AllowedRel</a> </li> <li> <a href="#Attr.AllowedRev">AllowedRev</a> </li> <li> <a href="#Attr.ClassUseCDATA">ClassUseCDATA</a> </li> <li> <a href="#Attr.DefaultImageAlt">DefaultImageAlt</a> </li> <li> <a href="#Attr.DefaultInvalidImage">DefaultInvalidImage</a> </li> <li> <a href= "#Attr.DefaultInvalidImageAlt">DefaultInvalidImageAlt</a> </li> <li> <a href="#Attr.DefaultTextDir">DefaultTextDir</a> </li> <li> <a href="#Attr.EnableID">EnableID</a> </li> <li> <a href="#Attr.ForbiddenClasses">ForbiddenClasses</a> </li> <li> <a href="#Attr.IDBlacklist">IDBlacklist</a> </li> <li> <a href="#Attr.IDBlacklistRegexp">IDBlacklistRegexp</a> </li> <li> <a href="#Attr.IDPrefix">IDPrefix</a> </li> <li> <a href="#Attr.IDPrefixLocal">IDPrefixLocal</a> </li> </ul> </li> <li> <a href="#AutoFormat">AutoFormat</a> <ul> <li> <a href="#AutoFormat.AutoParagraph">AutoParagraph</a> </li> <li> <a href="#AutoFormat.Custom">Custom</a> </li> <li> <a href="#AutoFormat.DisplayLinkURI">DisplayLinkURI</a> </li> <li> <a href="#AutoFormat.Linkify">Linkify</a> </li> <li> <a href= "#AutoFormat.PurifierLinkify.DocURL">PurifierLinkify.DocURL</a> </li> <li> <a href="#AutoFormat.PurifierLinkify">PurifierLinkify</a> </li> <li> <a href= "#AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions">RemoveEmpty.RemoveNbsp.Exceptions</a> </li> <li> <a href= "#AutoFormat.RemoveEmpty.RemoveNbsp">RemoveEmpty.RemoveNbsp</a> </li> <li> <a href="#AutoFormat.RemoveEmpty">RemoveEmpty</a> </li> <li> <a href= "#AutoFormat.RemoveSpansWithoutAttributes">RemoveSpansWithoutAttributes</a> </li> </ul> </li> <li> <a href="#CSS">CSS</a> <ul> <li> <a href="#CSS.AllowImportant">AllowImportant</a> </li> <li> <a href="#CSS.AllowTricky">AllowTricky</a> </li> <li> <a href="#CSS.AllowedFonts">AllowedFonts</a> </li> <li> <a href="#CSS.AllowedProperties">AllowedProperties</a> </li> <li> <a href="#CSS.DefinitionRev">DefinitionRev</a> </li> <li> <a href="#CSS.ForbiddenProperties">ForbiddenProperties</a> </li> <li> <a href="#CSS.MaxImgLength">MaxImgLength</a> </li> <li> <a href="#CSS.Proprietary">Proprietary</a> </li> <li> <a href="#CSS.Trusted">Trusted</a> </li> </ul> </li> <li> <a href="#Cache">Cache</a> <ul> <li> <a href="#Cache.DefinitionImpl">DefinitionImpl</a> </li> <li> <a href="#Cache.SerializerPath">SerializerPath</a> </li> <li> <a href= "#Cache.SerializerPermissions">SerializerPermissions</a> </li> </ul> </li> <li> <a href="#Core">Core</a> <ul> <li> <a href="#Core.AggressivelyFixLt">AggressivelyFixLt</a> </li> <li> <a href= "#Core.AllowHostnameUnderscore">AllowHostnameUnderscore</a> </li> <li> <a href="#Core.CollectErrors">CollectErrors</a> </li> <li> <a href="#Core.ColorKeywords">ColorKeywords</a> </li> <li> <a href= "#Core.ConvertDocumentToFragment">ConvertDocumentToFragment</a> </li> <li> <a href= "#Core.DirectLexLineNumberSyncInterval">DirectLexLineNumberSyncInterval</a> </li> <li> <a href="#Core.DisableExcludes">DisableExcludes</a> </li> <li> <a href="#Core.EnableIDNA">EnableIDNA</a> </li> <li> <a href="#Core.Encoding">Encoding</a> </li> <li> <a href="#Core.EscapeInvalidChildren">EscapeInvalidChildren</a> </li> <li> <a href="#Core.EscapeInvalidTags">EscapeInvalidTags</a> </li> <li> <a href= "#Core.EscapeNonASCIICharacters">EscapeNonASCIICharacters</a> </li> <li> <a href="#Core.HiddenElements">HiddenElements</a> </li> <li> <a href="#Core.Language">Language</a> </li> <li> <a href="#Core.LexerImpl">LexerImpl</a> </li> <li> <a href="#Core.MaintainLineNumbers">MaintainLineNumbers</a> </li> <li> <a href="#Core.NormalizeNewlines">NormalizeNewlines</a> </li> <li> <a href="#Core.RemoveInvalidImg">RemoveInvalidImg</a> </li> <li> <a href= "#Core.RemoveProcessingInstructions">RemoveProcessingInstructions</a> </li> </ul> </li> <li> <a href="#Filter">Filter</a> <ul> <li> <a href="#Filter.Custom">Custom</a> </li> <li> <a href= "#Filter.ExtractStyleBlocks.Escaping">ExtractStyleBlocks.Escaping</a> </li> <li> <a href= "#Filter.ExtractStyleBlocks.Scope">ExtractStyleBlocks.Scope</a> </li> <li> <a href= "#Filter.ExtractStyleBlocks.TidyImpl">ExtractStyleBlocks.TidyImpl</a> </li> <li> <a href="#Filter.ExtractStyleBlocks">ExtractStyleBlocks</a> </li> <li> <a href="#Filter.YouTube">YouTube</a> </li> </ul> <div class="col-l"></div> </li> <li class="col-2" style="margin-top:-88.8em"> <a href="#HTML">HTML</a> <ul> <li> <a href="#HTML.Allowed">Allowed</a> </li> <li> <a href="#HTML.AllowedAttributes">AllowedAttributes</a> </li> <li> <a href="#HTML.AllowedComments">AllowedComments</a> </li> <li> <a href="#HTML.AllowedCommentsRegexp">AllowedCommentsRegexp</a> </li> <li> <a href="#HTML.AllowedElements">AllowedElements</a> </li> <li> <a href="#HTML.AllowedModules">AllowedModules</a> </li> <li> <a href="#HTML.Attr.Name.UseCDATA">Attr.Name.UseCDATA</a> </li> <li> <a href="#HTML.BlockWrapper">BlockWrapper</a> </li> <li> <a href="#HTML.CoreModules">CoreModules</a> </li> <li> <a href="#HTML.CustomDoctype">CustomDoctype</a> </li> <li> <a href="#HTML.DefinitionID">DefinitionID</a> </li> <li> <a href="#HTML.DefinitionRev">DefinitionRev</a> </li> <li> <a href="#HTML.Doctype">Doctype</a> </li> <li> <a href="#HTML.FlashAllowFullScreen">FlashAllowFullScreen</a> </li> <li> <a href="#HTML.ForbiddenAttributes">ForbiddenAttributes</a> </li> <li> <a href="#HTML.ForbiddenElements">ForbiddenElements</a> </li> <li> <a href="#HTML.MaxImgLength">MaxImgLength</a> </li> <li> <a href="#HTML.Nofollow">Nofollow</a> </li> <li> <a href="#HTML.Parent">Parent</a> </li> <li> <a href="#HTML.Proprietary">Proprietary</a> </li> <li> <a href="#HTML.SafeEmbed">SafeEmbed</a> </li> <li> <a href="#HTML.SafeIframe">SafeIframe</a> </li> <li> <a href="#HTML.SafeObject">SafeObject</a> </li> <li> <a href="#HTML.SafeScripting">SafeScripting</a> </li> <li> <a href="#HTML.TargetBlank">TargetBlank</a> </li> <li> <a href="#HTML.TidyAdd">TidyAdd</a> </li> <li> <a href="#HTML.TidyLevel">TidyLevel</a> </li> <li> <a href="#HTML.TidyRemove">TidyRemove</a> </li> <li> <a href="#HTML.Trusted">Trusted</a> </li> </ul> </li> <li class="col-2"> <a href="#Output">Output</a> <ul> <li> <a href= "#Output.CommentScriptContents">CommentScriptContents</a> </li> <li> <a href="#Output.FixInnerHTML">FixInnerHTML</a> </li> <li> <a href="#Output.FlashCompat">FlashCompat</a> </li> <li> <a href="#Output.Newline">Newline</a> </li> <li> <a href="#Output.SortAttr">SortAttr</a> </li> <li> <a href="#Output.TidyFormat">TidyFormat</a> </li> </ul> </li> <li class="col-2"> <a href="#Test">Test</a> <ul> <li> <a href="#Test.ForceNoIconv">ForceNoIconv</a> </li> </ul> </li> <li class="col-2"> <a href="#URI">URI</a> <ul> <li> <a href="#URI.AllowedSchemes">AllowedSchemes</a> </li> <li> <a href="#URI.Base">Base</a> </li> <li> <a href="#URI.DefaultScheme">DefaultScheme</a> </li> <li> <a href="#URI.DefinitionID">DefinitionID</a> </li> <li> <a href="#URI.DefinitionRev">DefinitionRev</a> </li> <li> <a href="#URI.Disable">Disable</a> </li> <li> <a href="#URI.DisableExternal">DisableExternal</a> </li> <li> <a href= "#URI.DisableExternalResources">DisableExternalResources</a> </li> <li> <a href="#URI.DisableResources">DisableResources</a> </li> <li> <a href="#URI.Host">Host</a> </li> <li> <a href="#URI.HostBlacklist">HostBlacklist</a> </li> <li> <a href="#URI.MakeAbsolute">MakeAbsolute</a> </li> <li> <a href="#URI.Munge">Munge</a> </li> <li> <a href="#URI.MungeResources">MungeResources</a> </li> <li> <a href="#URI.MungeSecretKey">MungeSecretKey</a> </li> <li> <a href= "#URI.OverrideAllowedSchemes">OverrideAllowedSchemes</a> </li> <li> <a href="#URI.SafeIframeRegexp">SafeIframeRegexp</a> </li> </ul> </li> </ul> </div> <div id="typesContainer"> <h2> Types </h2> <div class="type-block" id="type-string"> <h3> <code>string</code>: String </h3> <div class="type-description"> A <a href= "http://docs.php.net/manual/en/language.types.string.php">sequence of characters</a>. </div> </div> <div class="type-block" id="type-istring"> <h3> <code>istring</code>: Case-insensitive string </h3> <div class="type-description"> A series of case-insensitive characters. Internally, upper-case ASCII characters will be converted to lower-case. </div> </div> <div class="type-block" id="type-text"> <h3> <code>text</code>: Text </h3> <div class="type-description"> A series of characters that may contain newlines. Text tends to indicate human-oriented text, as opposed to a machine format. </div> </div> <div class="type-block" id="type-itext"> <h3> <code>itext</code>: Case-insensitive text </h3> <div class="type-description"> A series of case-insensitive characters that may contain newlines. </div> </div> <div class="type-block" id="type-int"> <h3> <code>int</code>: Integer </h3> <div class="type-description"> An <a href= "http://docs.php.net/manual/en/language.types.integer.php">integer</a>. You are alternatively permitted to pass a string of digits instead, which will be cast to an integer using <code>(int)</code>. </div> </div> <div class="type-block" id="type-float"> <h3> <code>float</code>: Float </h3> <div class="type-description"> A <a href= "http://docs.php.net/manual/en/language.types.float.php">floating point number</a>. You are alternatively permitted to pass a numeric string (as defined by <code>is_numeric()</code>), which will be cast to a float using <code>(float)</code>. </div> </div> <div class="type-block" id="type-bool"> <h3> <code>bool</code>: Boolean </h3> <div class="type-description"> A <a href= "http://docs.php.net/manual/en/language.types.boolean.php">boolean</a>. You are alternatively permitted to pass an integer <code>0</code> or <code>1</code> (other integers are not permitted) or a string <code>"on"</code>, <code>"true"</code> or <code>"1"</code> for <code>true</code>, and <code>"off"</code>, <code>"false"</code> or <code>"0"</code> for <code>false</code>. </div> </div> <div class="type-block" id="type-lookup"> <h3> <code>lookup</code>: Lookup array </h3> <div class="type-description"> An array whose values are <code>true</code>, e.g. <code>array('key' => true, 'key2' => true)</code>. You are alternatively permitted to pass an array list of the keys <code>array('key', 'key2')</code> or a comma-separated string of keys <code>"key, key2"</code>. If you pass an array list of values, ensure that your values are strictly numerically indexed: <code>array('key1', 2 => 'key2')</code> will not do what you expect and emits a warning. </div> </div> <div class="type-block" id="type-list"> <h3> <code>list</code>: Array list </h3> <div class="type-description"> An array which has consecutive integer indexes, e.g. <code>array('val1', 'val2')</code>. You are alternatively permitted to pass a comma-separated string of keys <code>"val1, val2"</code>. If your array is not in this form, <code>array_values</code> is run on the array and a warning is emitted. </div> </div> <div class="type-block" id="type-hash"> <h3> <code>hash</code>: Associative array </h3> <div class="type-description"> An array which is a mapping of keys to values, e.g. <code>array('key1' => 'val1', 'key2' => 'val2')</code>. You are alternatively permitted to pass a comma-separated string of key-colon-value strings, e.g. <code>"key1: val1, key2: val2"</code>. </div> </div> <div class="type-block" id="type-mixed"> <h3> <code>mixed</code>: Mixed </h3> <div class="type-description"> An arbitrary PHP value of any type. </div> </div> </div> <div class="namespace"> <h2 id="Attr"> Attr </h2> <div class="directive"> <h3 id="Attr.AllowedClasses"> Attr.AllowedClasses </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/HTML/Class.php</em> on line 33 </li> </ul> </td> </tr> </table> <div class="description"> List of allowed class values in the class attribute. By default, this is null, which means all classes are allowed. </div> </div> <div class="directive"> <h3 id="Attr.AllowedFrameTargets"> Attr.AllowedFrameTargets </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/HTML/FrameTarget.php</em> on line 32 </li> </ul> </td> </tr> </table> <div class="description"> Lookup table of all allowed link frame targets. Some commonly used link targets include _blank, _self, _parent and _top. Values should be lowercase, as validation will be done in a case-sensitive manner despite W3C's recommendation. XHTML 1.0 Strict does not permit the target attribute so this directive will have no effect in that doctype. XHTML 1.1 does not enable the Target module by default, you will have to manually enable it (see the module documentation for more details.) </div> </div> <div class="directive"> <h3 id="Attr.AllowedRel"> Attr.AllowedRel </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.6.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> </table> <div class="description"> List of allowed forward document relationships in the rel attribute. Common values may be nofollow or print. By default, this is empty, meaning that no document relationships are allowed. </div> </div> <div class="directive"> <h3 id="Attr.AllowedRev"> Attr.AllowedRev </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.6.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> </table> <div class="description"> List of allowed reverse document relationships in the rev attribute. This attribute is a bit of an edge-case; if you don't know what it is for, stay away. </div> </div> <div class="directive"> <h3 id="Attr.ClassUseCDATA"> Attr.ClassUseCDATA </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> </table> <div class="description"> If null, class will auto-detect the doctype and, if matching XHTML 1.1 or XHTML 2.0, will use the restrictive NMTOKENS specification of class. Otherwise, it will use a relaxed CDATA definition. If true, the relaxed CDATA definition is forced; if false, the NMTOKENS definition is forced. To get behavior of HTML Purifier prior to 4.0.0, set this directive to false. Some rational behind the auto-detection: in previous versions of HTML Purifier, it was assumed that the form of class was NMTOKENS, as specified by the XHTML Modularization (representing XHTML 1.1 and XHTML 2.0). The DTDs for HTML 4.01 and XHTML 1.0, however specify class as CDATA. HTML 5 effectively defines it as CDATA, but with the additional constraint that each name should be unique (this is not explicitly outlined in previous specifications). </div> </div> <div class="directive"> <h3 id="Attr.DefaultImageAlt"> Attr.DefaultImageAlt </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrTransform/ImgRequired.php</em> on line 33 </li> </ul> </td> </tr> </table> <div class="description"> This is the content of the alt tag of an image if the user had not previously specified an alt attribute. This applies to all images without a valid alt attribute, as opposed to <a href= "#Attr.DefaultInvalidImageAlt">%Attr.DefaultInvalidImageAlt</a>, which only applies to invalid images, and overrides in the case of an invalid image. Default behavior with null is to use the basename of the src tag for the alt. </div> </div> <div class="directive"> <h3 id="Attr.DefaultInvalidImage"> Attr.DefaultInvalidImage </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>''</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrTransform/ImgRequired.php</em> on line 27 </li> </ul> </td> </tr> </table> <div class="description"> This is the default image an img tag will be pointed to if it does not have a valid src attribute. In future versions, we may allow the image tag to be removed completely, but due to design issues, this is not possible right now. </div> </div> <div class="directive"> <h3 id="Attr.DefaultInvalidImageAlt"> Attr.DefaultInvalidImageAlt </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'Invalid image'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrTransform/ImgRequired.php</em> on line 41 </li> </ul> </td> </tr> </table> <div class="description"> This is the content of the alt tag of an invalid image if the user had not previously specified an alt attribute. It has no effect when the image is valid but there was no alt attribute present. </div> </div> <div class="directive"> <h3 id="Attr.DefaultTextDir"> Attr.DefaultTextDir </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Allowed values </th> <td> "ltr", "rtl" </td> </tr> <tr> <th> Default </th> <td> <pre>'ltr'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrTransform/BdoDir.php</em> on line 22 </li> </ul> </td> </tr> </table> <div class="description"> Defines the default text direction (ltr or rtl) of the document being parsed. This generally is the same as the value of the dir attribute in HTML, or ltr if that is not specified. </div> </div> <div class="directive"> <a id="HTML.EnableAttrID" name="HTML.EnableAttrID"></a> <h3 id="Attr.EnableID"> Attr.EnableID </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Aliases </th> <td> HTML.EnableAttrID </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/HTML/ID.php</em> on line 41 </li> </ul> </td> </tr> </table> <div class="description"> Allows the ID attribute in HTML. This is disabled by default due to the fact that without proper configuration user input can easily break the validation of a webpage by specifying an ID that is already on the surrounding HTML. If you don't mind throwing caution to the wind, enable this directive, but I strongly recommend you also consider blacklisting IDs you use (<a href= "#Attr.IDBlacklist">%Attr.IDBlacklist</a>) or prefixing all user supplied IDs (<a href="#Attr.IDPrefix">%Attr.IDPrefix</a>). When set to true HTML Purifier reverts to the behavior of pre-1.2.0 versions. </div> </div> <div class="directive"> <h3 id="Attr.ForbiddenClasses"> Attr.ForbiddenClasses </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/HTML/Class.php</em> on line 34 </li> </ul> </td> </tr> </table> <div class="description"> List of forbidden class values in the class attribute. By default, this is empty, which means that no classes are forbidden. See also <a href="#Attr.AllowedClasses">%Attr.AllowedClasses</a>. </div> </div> <div class="directive"> <h3 id="Attr.IDBlacklist"> Attr.IDBlacklist </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-list"> <a href="#type-list">Array list</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/IDAccumulator.php</em> on line 27 </li> </ul> </td> </tr> </table> <div class="description"> Array of IDs not allowed in the document. </div> </div> <div class="directive"> <h3 id="Attr.IDBlacklistRegexp"> Attr.IDBlacklistRegexp </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.6.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/HTML/ID.php</em> on line 89 </li> </ul> </td> </tr> </table> <div class="description"> PCRE regular expression to be matched against all IDs. If the expression is matches, the ID is rejected. Use this with care: may cause significant degradation. ID matching is done after all other validation. </div> </div> <div class="directive"> <h3 id="Attr.IDPrefix"> Attr.IDPrefix </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>''</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/HTML/ID.php</em> on line 51 </li> </ul> </td> </tr> </table> <div class="description"> String to prefix to IDs. If you have no idea what IDs your pages may use, you may opt to simply add a prefix to all user-submitted ID attributes so that they are still usable, but will not conflict with core page IDs. Example: setting the directive to 'user_' will result in a user submitted 'foo' to become 'user_foo' Be sure to set <a href="#HTML.EnableAttrID">%HTML.EnableAttrID</a> to true before using this. </div> </div> <div class="directive"> <h3 id="Attr.IDPrefixLocal"> Attr.IDPrefixLocal </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>''</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/HTML/ID.php</em> on lines 53, 58 </li> </ul> </td> </tr> </table> <div class="description"> Temporary prefix for IDs used in conjunction with <a href= "#Attr.IDPrefix">%Attr.IDPrefix</a>. If you need to allow multiple sets of user content on web page, you may need to have a seperate prefix that changes with each iteration. This way, seperately submitted user content displayed on the same page doesn't clobber each other. Ideal values are unique identifiers for the content it represents (i.e. the id of the row in the database). Be sure to add a seperator (like an underscore) at the end. Warning: this directive will not work unless <a href= "#Attr.IDPrefix">%Attr.IDPrefix</a> is set to a non-empty value! </div> </div> </div> <div class="namespace"> <h2 id="AutoFormat"> AutoFormat </h2> <div class="directive"> <h3 id="AutoFormat.AutoParagraph"> AutoFormat.AutoParagraph </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> This directive turns on auto-paragraphing, where double newlines are converted in to paragraphs whenever possible. Auto-paragraphing: </p> <ul> <li>Always applies to inline elements or text in the root node, </li> <li>Applies to inline elements or text with double newlines in nodes that allow paragraph tags, </li> <li>Applies to double newlines in paragraph tags </li> </ul> <p> <code>p</code> tags must be allowed for this directive to take effect. We do not use <code>br</code> tags for paragraphing, as that is semantically incorrect. </p> <p> To prevent auto-paragraphing as a content-producer, refrain from using double-newlines except to specify a new paragraph or in contexts where it has special meaning (whitespace usually has no meaning except in tags like <code>pre</code>, so this should not be difficult.) To prevent the paragraphing of inline text adjacent to block elements, wrap them in <code>div</code> tags (the behavior is slightly different outside of the root node.) </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.Custom"> AutoFormat.Custom </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-list"> <a href="#type-list">Array list</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> </table> <div class="description"> <p> This directive can be used to add custom auto-format injectors. Specify an array of injector names (class name minus the prefix) or concrete implementations. Injector class must exist. </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.DisplayLinkURI"> AutoFormat.DisplayLinkURI </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> This directive turns on the in-text display of URIs in <a> tags, and disables those links. For example, <a href= "http://example.com">example</a> becomes example (<a>http://example.com</a>). </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.Linkify"> AutoFormat.Linkify </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> This directive turns on linkification, auto-linking http, ftp and https URLs. <code>a</code> tags with the <code>href</code> attribute must be allowed. </p> </div> </div> <div class="directive"> <a id="AutoFormatParam.PurifierLinkifyDocURL" name= "AutoFormatParam.PurifierLinkifyDocURL"></a> <h3 id="AutoFormat.PurifierLinkify.DocURL"> AutoFormat.PurifierLinkify.DocURL </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'#%s'</pre> </td> </tr> <tr> <th> Aliases </th> <td> AutoFormatParam.PurifierLinkifyDocURL </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Injector/PurifierLinkify.php</em> on line 31 </li> </ul> </td> </tr> </table> <div class="description"> <p> Location of configuration documentation to link to, let %s substitute into the configuration's namespace and directive names sans the percent sign. </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.PurifierLinkify"> AutoFormat.PurifierLinkify </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> Internal auto-formatter that converts configuration directives in syntax <a>%Namespace.Directive</a> to links. <code>a</code> tags with the <code>href</code> attribute must be allowed. </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions"> AutoFormat.RemoveEmpty.RemoveNbsp.Exceptions </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array ( 'td' => true, 'th' => true, )</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Injector/RemoveEmpty.php</em> on line 47 </li> </ul> </td> </tr> </table> <div class="description"> <p> When <a href= "#AutoFormat.RemoveEmpty">%AutoFormat.RemoveEmpty</a> and <a href="#AutoFormat.RemoveEmpty">%AutoFormat.RemoveEmpty</a>.RemoveNbsp are enabled, this directive defines what HTML elements should not be removede if they have only a non-breaking space in them. </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.RemoveEmpty.RemoveNbsp"> AutoFormat.RemoveEmpty.RemoveNbsp </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Injector/RemoveEmpty.php</em> on line 46 </li> </ul> </td> </tr> </table> <div class="description"> <p> When enabled, HTML Purifier will treat any elements that contain only non-breaking spaces as well as regular whitespace as empty, and remove them when <a href= "#AutoForamt.RemoveEmpty">%AutoForamt.RemoveEmpty</a> is enabled. </p> <p> See <a href= "#AutoFormat.RemoveEmpty">%AutoFormat.RemoveEmpty</a>.RemoveNbsp.Exceptions for a list of elements that don't have this behavior applied to them. </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.RemoveEmpty"> AutoFormat.RemoveEmpty </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> When enabled, HTML Purifier will attempt to remove empty elements that contribute no semantic information to the document. The following types of nodes will be removed: </p> <ul> <li>Tags with no attributes and no content, and that are not empty elements (remove <code><a></a></code> but not <code><br /></code>), and </li> <li>Tags with no content, except for: <ul> <li>The <code>colgroup</code> element, or </li> <li>Elements with the <code>id</code> or <code>name</code> attribute, when those attributes are permitted on those elements. </li> </ul> </li> </ul> <p> Please be very careful when using this functionality; while it may not seem that empty elements contain useful information, they can alter the layout of a document given appropriate styling. This directive is most useful when you are processing machine-generated HTML, please avoid using it on regular user HTML. </p> <p> Elements that contain only whitespace will be treated as empty. Non-breaking spaces, however, do not count as whitespace. See <a href= "#AutoFormat.RemoveEmpty">%AutoFormat.RemoveEmpty</a>.RemoveNbsp for alternate behavior. </p> <p> This algorithm is not perfect; you may still notice some empty tags, particularly if a node had elements, but those elements were later removed because they were not permitted in that context, or tags that, after being auto-closed by another tag, where empty. This is for safety reasons to prevent clever code from breaking validation. The general rule of thumb: if a tag looked empty on the way in, it will get removed; if HTML Purifier made it empty, it will stay. </p> </div> </div> <div class="directive"> <h3 id="AutoFormat.RemoveSpansWithoutAttributes"> AutoFormat.RemoveSpansWithoutAttributes </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> This directive causes <code>span</code> tags without any attributes to be removed. It will also remove spans that had all attributes removed during processing. </p> </div> </div> </div> <div class="namespace"> <h2 id="CSS"> CSS </h2> <div class="directive"> <h3 id="CSS.AllowImportant"> CSS.AllowImportant </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/CSSDefinition.php</em> on line 331 </li> </ul> </td> </tr> </table> <div class="description"> This parameter determines whether or not !important cascade modifiers should be allowed in user CSS. If false, !important will stripped. </div> </div> <div class="directive"> <h3 id="CSS.AllowTricky"> CSS.AllowTricky </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/CSSDefinition.php</em> on line 323 </li> </ul> </td> </tr> </table> <div class="description"> This parameter determines whether or not to allow "tricky" CSS properties and values. Tricky CSS properties/values can drastically modify page layout or be used for deceptive practices but do not directly constitute a security risk. For example, <code>display:none;</code> is considered a tricky property that will only be allowed if this directive is set to true. </div> </div> <div class="directive"> <h3 id="CSS.AllowedFonts"> CSS.AllowedFonts </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/CSS/FontFamily.php</em> on line 64 </li> </ul> </td> </tr> </table> <div class="description"> <p> Allows you to manually specify a set of allowed fonts. If <code>NULL</code>, all fonts are allowed. This directive affects generic names (serif, sans-serif, monospace, cursive, fantasy) as well as specific font families. </p> </div> </div> <div class="directive"> <h3 id="CSS.AllowedProperties"> CSS.AllowedProperties </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/CSSDefinition.php</em> on line 447 </li> </ul> </td> </tr> </table> <div class="description"> <p> If HTML Purifier's style attributes set is unsatisfactory for your needs, you can overload it with your own list of tags to allow. Note that this method is subtractive: it does its job by taking away from HTML Purifier usual feature set, so you cannot add an attribute that HTML Purifier never supported in the first place. </p> <p> <strong>Warning:</strong> If another directive conflicts with the elements here, <em>that</em> directive will win and override. </p> </div> </div> <div class="directive"> <h3 id="CSS.DefinitionRev"> CSS.DefinitionRev </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-int"> <a href="#type-int">Integer</a> </td> </tr> <tr> <th> Default </th> <td> <pre>1</pre> </td> </tr> </table> <div class="description"> <p> Revision identifier for your custom definition. See <a href= "#HTML.DefinitionRev">%HTML.DefinitionRev</a> for details. </p> </div> </div> <div class="directive"> <h3 id="CSS.ForbiddenProperties"> CSS.ForbiddenProperties </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/CSSDefinition.php</em> on line 463 </li> </ul> </td> </tr> </table> <div class="description"> <p> This is the logical inverse of <a href= "#CSS.AllowedProperties">%CSS.AllowedProperties</a>, and it will override that directive or any other directive. If possible, <a href="#CSS.AllowedProperties">%CSS.AllowedProperties</a> is recommended over this directive, because it can sometimes be difficult to tell whether or not you've forbidden all of the CSS properties you truly would like to disallow. </p> </div> </div> <div class="directive"> <h3 id="CSS.MaxImgLength"> CSS.MaxImgLength </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.1 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'1200px'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/CSSDefinition.php</em> on line 226 </li> </ul> </td> </tr> </table> <div class="description"> <p> This parameter sets the maximum allowed length on <code>img</code> tags, effectively the <code>width</code> and <code>height</code> properties. Only absolute units of measurement (in, pt, pc, mm, cm) and pixels (px) are allowed. This is in place to prevent imagecrash attacks, disable with null at your own risk. This directive is similar to <a href= "#HTML.MaxImgLength">%HTML.MaxImgLength</a>, and both should be concurrently edited, although there are subtle differences in the input format (the CSS max is a number with a unit). </p> </div> </div> <div class="directive"> <h3 id="CSS.Proprietary"> CSS.Proprietary </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/CSSDefinition.php</em> on line 319 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to allow safe, proprietary CSS values. </p> </div> </div> <div class="directive"> <h3 id="CSS.Trusted"> CSS.Trusted </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.2.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/CSSDefinition.php</em> on line 327 </li> </ul> </td> </tr> </table> <div class="description"> Indicates whether or not the user's CSS input is trusted or not. If the input is trusted, a more expansive set of allowed properties. See also <a href="#HTML.Trusted">%HTML.Trusted</a>. </div> </div> </div> <div class="namespace"> <h2 id="Cache"> Cache </h2> <div class="directive"> <a id="Core.DefinitionCache" name="Core.DefinitionCache"></a> <h3 id="Cache.DefinitionImpl"> Cache.DefinitionImpl </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'Serializer'</pre> </td> </tr> <tr> <th> Aliases </th> <td> Core.DefinitionCache </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/DefinitionCacheFactory.php</em> on line 66 </li> </ul> </td> </tr> </table> <div class="description"> This directive defines which method to use when caching definitions, the complex data-type that makes HTML Purifier tick. Set to null to disable caching (not recommended, as you will see a definite performance degradation). </div> </div> <div class="directive"> <h3 id="Cache.SerializerPath"> Cache.SerializerPath </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/DefinitionCache/Serializer.php</em> on line 171 </li> </ul> </td> </tr> </table> <div class="description"> <p> Absolute path with no trailing slash to store serialized definitions in. Default is within the HTML Purifier library inside DefinitionCache/Serializer. This path must be writable by the webserver. </p> </div> </div> <div class="directive"> <h3 id="Cache.SerializerPermissions"> Cache.SerializerPermissions </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-int"> <a href="#type-int">Integer</a> </td> </tr> <tr> <th> Default </th> <td> <pre>493</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/DefinitionCache/Serializer.php</em> on lines 188, 206 </li> </ul> </td> </tr> </table> <div class="description"> <p> Directory permissions of the files and directories created inside the DefinitionCache/Serializer or other custom serializer path. </p> </div> </div> </div> <div class="namespace"> <h2 id="Core"> Core </h2> <div class="directive"> <h3 id="Core.AggressivelyFixLt"> Core.AggressivelyFixLt </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Lexer/DOMLex.php</em> on line 54 </li> </ul> </td> </tr> </table> <div class="description"> <p> This directive enables aggressive pre-filter fixes HTML Purifier can perform in order to ensure that open angled-brackets do not get killed during parsing stage. Enabling this will result in two preg_replace_callback calls and at least two preg_replace calls for every HTML document parsed; if your users make very well-formed HTML, you can set this directive false. This has no effect when DirectLex is used. </p> <p> <strong>Notice:</strong> This directive's default turned from false to true in HTML Purifier 3.2.0. </p> </div> </div> <div class="directive"> <h3 id="Core.AllowHostnameUnderscore"> Core.AllowHostnameUnderscore </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.6.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/URI/Host.php</em> on line 77 </li> </ul> </td> </tr> </table> <div class="description"> <p> By RFC 1123, underscores are not permitted in host names. (This is in contrast to the specification for DNS, RFC 2181, which allows underscores.) However, most browsers do the right thing when faced with an underscore in the host name, and so some poorly written websites are written with the expectation this should work. Setting this parameter to true relaxes our allowed character check so that underscores are permitted. </p> </div> </div> <div class="directive"> <h3 id="Core.CollectErrors"> Core.CollectErrors </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier.php</em> on line 162 </li> <li> <em>HTMLPurifier/Lexer.php</em> on lines 85, 315 </li> <li> <em>HTMLPurifier/Lexer/DirectLex.php</em> on lines 67, 87, 385 </li> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 57 </li> </ul> </td> </tr> </table> <div class="description"> Whether or not to collect errors found while filtering the document. This is a useful way to give feedback to your users. <strong>Warning:</strong> Currently this feature is very patchy and experimental, with lots of possible error messages not yet implemented. It will not cause any problems, but it may not help your users either. </div> </div> <div class="directive"> <h3 id="Core.ColorKeywords"> Core.ColorKeywords </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-hash"> <a href="#type-hash">Associative array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array ( 'maroon' => '#800000', 'red' => '#FF0000', 'orange' => '#FFA500', 'yellow' => '#FFFF00', 'olive' => '#808000', 'purple' => '#800080', 'fuchsia' => '#FF00FF', 'white' => '#FFFFFF', 'lime' => '#00FF00', 'green' => '#008000', 'navy' => '#000080', 'blue' => '#0000FF', 'aqua' => '#00FFFF', 'teal' => '#008080', 'black' => '#000000', 'silver' => '#C0C0C0', 'gray' => '#808080', )</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/CSS/Color.php</em> on line 19 </li> <li> <em>HTMLPurifier/AttrDef/HTML/Color.php</em> on line 19 </li> </ul> </td> </tr> </table> <div class="description"> Lookup array of color names to six digit hexadecimal number corresponding to color, with preceding hash mark. Used when parsing colors. The lookup is done in a case-insensitive manner. </div> </div> <div class="directive"> <a id="Core.AcceptFullDocuments" name="Core.AcceptFullDocuments"></a> <h3 id="Core.ConvertDocumentToFragment"> Core.ConvertDocumentToFragment </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Aliases </th> <td> Core.AcceptFullDocuments </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Lexer.php</em> on line 313 </li> </ul> </td> </tr> </table> <div class="description"> This parameter determines whether or not the filter should convert input that is a full document with html and body tags to a fragment of just the contents of a body tag. This parameter is simply something HTML Purifier can do during an edge-case: for most inputs, this processing is not necessary. </div> </div> <div class="directive"> <h3 id="Core.DirectLexLineNumberSyncInterval"> Core.DirectLexLineNumberSyncInterval </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-int"> <a href="#type-int">Integer</a> </td> </tr> <tr> <th> Default </th> <td> <pre>0</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Lexer/DirectLex.php</em> on line 84 </li> </ul> </td> </tr> </table> <div class="description"> <p> Specifies the number of tokens the DirectLex line number tracking implementations should process before attempting to resyncronize the current line count by manually counting all previous new-lines. When at 0, this functionality is disabled. Lower values will decrease performance, and this is only strictly necessary if the counting algorithm is buggy (in which case you should report it as a bug). This has no effect when <a href= "#Core.MaintainLineNumbers">%Core.MaintainLineNumbers</a> is disabled or DirectLex is not being used. </p> </div> </div> <div class="directive"> <h3 id="Core.DisableExcludes"> Core.DisableExcludes </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.5.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Strategy/FixNesting.php</em> on line 54 </li> </ul> </td> </tr> </table> <div class="description"> <p> This directive disables SGML-style exclusions, e.g. the exclusion of <code><object></code> in any descendant of a <code><pre></code> tag. Disabling excludes will allow some invalid documents to pass through HTML Purifier, but HTML Purifier will also be less likely to accidentally remove large documents during processing. </p> </div> </div> <div class="directive"> <h3 id="Core.EnableIDNA"> Core.EnableIDNA </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.4.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/URI/Host.php</em> on line 96 </li> </ul> </td> </tr> </table> <div class="description"> Allows international domain names in URLs. This configuration option requires the PEAR Net_IDNA2 module to be installed. It operates by punycoding any internationalized host names for maximum portability. </div> </div> <div class="directive"> <h3 id="Core.Encoding"> Core.Encoding </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-istring"> <a href="#type-istring">Case-insensitive string</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'utf-8'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Encoder.php</em> on lines 374, 422 </li> </ul> </td> </tr> </table> <div class="description"> If for some reason you are unable to convert all webpages to UTF-8, you can use this directive as a stop-gap compatibility change to let HTML Purifier deal with non UTF-8 input. This technique has notable deficiencies: absolutely no characters outside of the selected character encoding will be preserved, not even the ones that have been ampersand escaped (this is due to a UTF-8 specific <em>feature</em> that automatically resolves all entities), making it pretty useless for anything except the most I18N-blind applications, although <a href= "#Core.EscapeNonASCIICharacters">%Core.EscapeNonASCIICharacters</a> offers fixes this trouble with another tradeoff. This directive only accepts ISO-8859-1 if iconv is not enabled. </div> </div> <div class="directive"> <h3 id="Core.EscapeInvalidChildren"> Core.EscapeInvalidChildren </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> <strong>Warning:</strong> this configuration option is no longer does anything as of 4.6.0. </p> <p> When true, a child is found that is not allowed in the context of the parent element will be transformed into text as if it were ASCII. When false, that element and all internal tags will be dropped, though text will be preserved. There is no option for dropping the element but preserving child nodes. </p> </div> </div> <div class="directive"> <h3 id="Core.EscapeInvalidTags"> Core.EscapeInvalidTags </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Strategy/MakeWellFormed.php</em> on line 72 </li> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 26 </li> </ul> </td> </tr> </table> <div class="description"> When true, invalid tags will be written back to the document as plain text. Otherwise, they are silently dropped. </div> </div> <div class="directive"> <h3 id="Core.EscapeNonASCIICharacters"> Core.EscapeNonASCIICharacters </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.4.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Encoder.php</em> on line 423 </li> </ul> </td> </tr> </table> <div class="description"> This directive overcomes a deficiency in <a href= "#Core.Encoding">%Core.Encoding</a> by blindly converting all non-ASCII characters into decimal numeric entities before converting it to its native encoding. This means that even characters that can be expressed in the non-UTF-8 encoding will be entity-ized, which can be a real downer for encodings like Big5. It also assumes that the ASCII repetoire is available, although this is the case for almost all encodings. Anyway, use UTF-8! </div> </div> <div class="directive"> <h3 id="Core.HiddenElements"> Core.HiddenElements </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array ( 'script' => true, 'style' => true, )</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 36 </li> </ul> </td> </tr> </table> <div class="description"> <p> This directive is a lookup array of elements which should have their contents removed when they are not allowed by the HTML definition. For example, the contents of a <code>script</code> tag are not normally shown in a document, so if script tags are to be removed, their contents should be removed to. This is opposed to a <code>b</code> tag, which defines some presentational changes but does not hide its contents. </p> </div> </div> <div class="directive"> <h3 id="Core.Language"> Core.Language </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'en'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/LanguageFactory.php</em> on line 93 </li> </ul> </td> </tr> </table> <div class="description"> ISO 639 language code for localizable things in HTML Purifier to use, which is mainly error reporting. There is currently only an English (en) translation, so this directive is currently useless. </div> </div> <div class="directive"> <h3 id="Core.LexerImpl"> Core.LexerImpl </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-mixed"> <a href="#type-mixed">Mixed (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Lexer.php</em> on line 80 </li> </ul> </td> </tr> </table> <div class="description"> <p> This parameter determines what lexer implementation can be used. The valid values are: </p> <dl> <dt> <em>null</em> </dt> <dd> Recommended, the lexer implementation will be auto-detected based on your PHP-version and configuration. </dd> <dt> <em>string</em> lexer identifier </dt> <dd> This is a slim way of manually overridding the implementation. Currently recognized values are: DOMLex (the default PHP5 implementation) and DirectLex (the default PHP4 implementation). Only use this if you know what you are doing: usually, the auto-detection will manage things for cases you aren't even aware of. </dd> <dt> <em>object</em> lexer instance </dt> <dd> Super-advanced: you can specify your own, custom, implementation that implements the interface defined by <code>HTMLPurifier_Lexer</code>. I may remove this option simply because I don't expect anyone to use it. </dd> </dl> </div> </div> <div class="directive"> <h3 id="Core.MaintainLineNumbers"> Core.MaintainLineNumbers </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Lexer.php</em> on line 84 </li> <li> <em>HTMLPurifier/Lexer/DirectLex.php</em> on line 62 </li> </ul> </td> </tr> </table> <div class="description"> <p> If true, HTML Purifier will add line number information to all tokens. This is useful when error reporting is turned on, but can result in significant performance degradation and should not be used when unnecessary. This directive must be used with the DirectLex lexer, as the DOMLex lexer does not (yet) support this functionality. If the value is null, an appropriate value will be selected based on other configuration. </p> </div> </div> <div class="directive"> <h3 id="Core.NormalizeNewlines"> Core.NormalizeNewlines </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Generator.php</em> on line 122 </li> <li> <em>HTMLPurifier/Lexer.php</em> on line 297 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to normalize newlines to the operating system default. When <code>false</code>, HTML Purifier will attempt to preserve mixed newline files. </p> </div> </div> <div class="directive"> <h3 id="Core.RemoveInvalidImg"> Core.RemoveInvalidImg </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrTransform/ImgRequired.php</em> on line 24 </li> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 27 </li> </ul> </td> </tr> </table> <div class="description"> <p> This directive enables pre-emptive URI checking in <code>img</code> tags, as the attribute validation strategy is not authorized to remove elements from the document. Revert to pre-1.3.0 behavior by setting to false. </p> </div> </div> <div class="directive"> <h3 id="Core.RemoveProcessingInstructions"> Core.RemoveProcessingInstructions </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Lexer.php</em> on line 334 </li> </ul> </td> </tr> </table> <div class="description"> Instead of escaping processing instructions in the form <code><? ... ?></code>, remove it out-right. This may be useful if the HTML you are validating contains XML processing instruction gunk, however, it can also be user-unfriendly for people attempting to post PHP snippets. </div> </div> <div class="directive deprecated"> <h3 id="Core.RemoveScriptContents"> Core.RemoveScriptContents </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 35 </li> </ul> </td> </tr> </table> <div class="deprecated-notice"> <strong>Warning:</strong> This directive was deprecated in version 2.1.0. <a href="#Core.HiddenElements">%Core.HiddenElements</a> should be used instead. </div> <div class="description"> <p> This directive enables HTML Purifier to remove not only script tags but all of their contents. </p> </div> </div> </div> <div class="namespace"> <h2 id="Filter"> Filter </h2> <div class="directive"> <h3 id="Filter.Custom"> Filter.Custom </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-list"> <a href="#type-list">Array list</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> </table> <div class="description"> <p> This directive can be used to add custom filters; it is nearly the equivalent of the now deprecated <code>HTMLPurifier->addFilter()</code> method. Specify an array of concrete implementations. </p> </div> </div> <div class="directive"> <a id="Filter.ExtractStyleBlocksEscaping" name= "Filter.ExtractStyleBlocksEscaping"></a><a id= "FilterParam.ExtractStyleBlocksEscaping" name= "FilterParam.ExtractStyleBlocksEscaping"></a> <h3 id="Filter.ExtractStyleBlocks.Escaping"> Filter.ExtractStyleBlocks.Escaping </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Aliases </th> <td> Filter.ExtractStyleBlocksEscaping, FilterParam.ExtractStyleBlocksEscaping </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Filter/ExtractStyleBlocks.php</em> on line 327 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to escape the dangerous characters <, > and & as \3C, \3E and \26, respectively. This is can be safely set to false if the contents of StyleBlocks will be placed in an external stylesheet, where there is no risk of it being interpreted as HTML. </p> </div> </div> <div class="directive"> <a id="Filter.ExtractStyleBlocksScope" name= "Filter.ExtractStyleBlocksScope"></a><a id= "FilterParam.ExtractStyleBlocksScope" name= "FilterParam.ExtractStyleBlocksScope"></a> <h3 id="Filter.ExtractStyleBlocks.Scope"> Filter.ExtractStyleBlocks.Scope </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Aliases </th> <td> Filter.ExtractStyleBlocksScope, FilterParam.ExtractStyleBlocksScope </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Filter/ExtractStyleBlocks.php</em> on line 122 </li> </ul> </td> </tr> </table> <div class="description"> <p> If you would like users to be able to define external stylesheets, but only allow them to specify CSS declarations for a specific node and prevent them from fiddling with other elements, use this directive. It accepts any valid CSS selector, and will prepend this to any CSS declaration extracted from the document. For example, if this directive is set to <code>#user-content</code> and a user uses the selector <code>a:hover</code>, the final selector will be <code>#user-content a:hover</code>. </p> <p> The comma shorthand may be used; consider the above example, with <code>#user-content, #user-content2</code>, the final selector will be <code>#user-content a:hover, #user-content2 a:hover</code>. </p> <p> <strong>Warning:</strong> It is possible for users to bypass this measure using a naughty + selector. This is a bug in CSS Tidy 1.3, not HTML Purifier, and I am working to get it fixed. Until then, HTML Purifier performs a basic check to prevent this. </p> </div> </div> <div class="directive"> <a id="FilterParam.ExtractStyleBlocksTidyImpl" name= "FilterParam.ExtractStyleBlocksTidyImpl"></a> <h3 id="Filter.ExtractStyleBlocks.TidyImpl"> Filter.ExtractStyleBlocks.TidyImpl </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-mixed"> <a href="#type-mixed">Mixed (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Aliases </th> <td> FilterParam.ExtractStyleBlocksTidyImpl </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Filter/ExtractStyleBlocks.php</em> on line 94 </li> </ul> </td> </tr> </table> <div class="description"> <p> If left NULL, HTML Purifier will attempt to instantiate a <code>csstidy</code> class to use for internal cleaning. This will usually be good enough. </p> <p> However, for trusted user input, you can set this to <code>false</code> to disable cleaning. In addition, you can supply your own concrete implementation of Tidy's interface to use, although I don't know why you'd want to do that. </p> </div> </div> <div class="directive"> <h3 id="Filter.ExtractStyleBlocks"> Filter.ExtractStyleBlocks </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> External deps </th> <td> <ul> <li>CSSTidy </li> </ul> </td> </tr> </table> <div class="description"> <p> This directive turns on the style block extraction filter, which removes <code>style</code> blocks from input HTML, cleans them up with CSSTidy, and places them in the <code>StyleBlocks</code> context variable, for further use by you, usually to be placed in an external stylesheet, or a <code>style</code> block in the <code>head</code> of your document. </p> <p> Sample usage: </p> <pre> <?php header('Content-type: text/html; charset=utf-8'); echo '<?xml version="1.0" encoding="UTF-8"?>'; ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>Filter.ExtractStyleBlocks</title> <?php require_once '/path/to/library/HTMLPurifier.auto.php'; require_once '/path/to/csstidy.class.php'; $dirty = '<style>body {color:#F00;}</style> Some text'; $config = HTMLPurifier_Config::createDefault(); $config->set('Filter', 'ExtractStyleBlocks', true); $purifier = new HTMLPurifier($config); $html = $purifier->purify($dirty); // This implementation writes the stylesheets to the styles/ directory. // You can also echo the styles inside the document, but it's a bit // more difficult to make sure they get interpreted properly by // browsers; try the usual CSS armoring techniques. $styles = $purifier->context->get('StyleBlocks'); $dir = 'styles/'; if (!is_dir($dir)) mkdir($dir); $hash = sha1($_GET['html']); foreach ($styles as $i => $style) { file_put_contents($name = $dir . $hash . "_$i"); echo '<link rel="stylesheet" type="text/css" href="'.$name.'" />'; } ?> </head> <body> <div> <?php echo $html; ?> </div> </body> </html> </pre> <p> <strong>Warning:</strong> It is possible for a user to mount an imagecrash attack using this CSS. Counter-measures are difficult; it is not simply enough to limit the range of CSS lengths (using relative lengths with many nesting levels allows for large values to be attained without actually specifying them in the stylesheet), and the flexible nature of selectors makes it difficult to selectively disable lengths on image tags (HTML Purifier, however, does disable CSS width and height in inline styling). There are probably two effective counter measures: an explicit width and height set to auto in all images in your document (unlikely) or the disabling of width and height (somewhat reasonable). Whether or not these measures should be used is left to the reader. </p> </div> </div> <div class="directive"> <h3 id="Filter.YouTube"> Filter.YouTube </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> <strong>Warning:</strong> Deprecated in favor of <a href= "#HTML.SafeObject">%HTML.SafeObject</a> and <a href= "#Output.FlashCompat">%Output.FlashCompat</a> (turn both on to allow YouTube videos and other Flash content). </p> <p> This directive enables YouTube video embedding in HTML Purifier. Check <a href= "http://htmlpurifier.org/docs/enduser-youtube.html">this document on embedding videos</a> for more information on what this filter does. </p> </div> </div> </div> <div class="namespace"> <h2 id="HTML"> HTML </h2> <div class="directive"> <h3 id="HTML.Allowed"> HTML.Allowed </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-itext"> <a href="#type-itext">Case-insensitive text (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLDefinition.php</em> on line 295 </li> </ul> </td> </tr> </table> <div class="description"> <p> This is a preferred convenience directive that combines <a href= "#HTML.AllowedElements">%HTML.AllowedElements</a> and <a href= "#HTML.AllowedAttributes">%HTML.AllowedAttributes</a>. Specify elements and attributes that are allowed using: <code>element1[attr1|attr2],element2...</code>. For example, if you would like to only allow paragraphs and links, specify <code>a[href],p</code>. You can specify attributes that apply to all elements using an asterisk, e.g. <code>*[lang]</code>. You can also use newlines instead of commas to separate elements. </p> <p> <strong>Warning</strong>: All of the constraints on the component directives are still enforced. The syntax is a <em>subset</em> of TinyMCE's <code>valid_elements</code> whitelist: directly copy-pasting it here will probably result in broken whitelists. If <a href="#HTML.AllowedElements">%HTML.AllowedElements</a> or <a href="#HTML.AllowedAttributes">%HTML.AllowedAttributes</a> are set, this directive has no effect. </p> </div> </div> <div class="directive"> <h3 id="HTML.AllowedAttributes"> HTML.AllowedAttributes </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLDefinition.php</em> on line 292 </li> </ul> </td> </tr> </table> <div class="description"> <p> If HTML Purifier's attribute set is unsatisfactory, overload it! The syntax is "tag.attr" or "*.attr" for the global attributes (style, id, class, dir, lang, xml:lang). </p> <p> <strong>Warning:</strong> If another directive conflicts with the elements here, <em>that</em> directive will win and override. For example, <a href="#HTML.EnableAttrID">%HTML.EnableAttrID</a> will take precedence over *.id in this directive. You must set that directive to true before you can use IDs at all. </p> </div> </div> <div class="directive"> <h3 id="HTML.AllowedComments"> HTML.AllowedComments </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.4.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 31 </li> </ul> </td> </tr> </table> <div class="description"> A whitelist which indicates what explicit comment bodies should be allowed, modulo leading and trailing whitespace. See also <a href= "#HTML.AllowedCommentsRegexp">%HTML.AllowedCommentsRegexp</a> (these directives are union'ed together, so a comment is considered valid if any directive deems it valid.) </div> </div> <div class="directive"> <h3 id="HTML.AllowedCommentsRegexp"> HTML.AllowedCommentsRegexp </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.4.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 32 </li> </ul> </td> </tr> </table> <div class="description"> A regexp, which if it matches the body of a comment, indicates that it should be allowed. Trailing and leading spaces are removed prior to running this regular expression. <strong>Warning:</strong> Make sure you specify correct anchor metacharacters <code>^regex$</code>, otherwise you may accept comments that you did not mean to! In particular, the regex <code>/foo|bar/</code> is probably not sufficiently strict, since it also allows <code>foobar</code>. See also <a href= "#HTML.AllowedComments">%HTML.AllowedComments</a> (these directives are union'ed together, so a comment is considered valid if any directive deems it valid.) </div> </div> <div class="directive"> <h3 id="HTML.AllowedElements"> HTML.AllowedElements </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLDefinition.php</em> on line 291 </li> </ul> </td> </tr> </table> <div class="description"> <p> If HTML Purifier's tag set is unsatisfactory for your needs, you can overload it with your own list of tags to allow. If you change this, you probably also want to change <a href= "#HTML.AllowedAttributes">%HTML.AllowedAttributes</a>; see also <a href="#HTML.Allowed">%HTML.Allowed</a> which lets you set allowed elements and attributes at the same time. </p> <p> If you attempt to allow an element that HTML Purifier does not know about, HTML Purifier will raise an error. You will need to manually tell HTML Purifier about this element by using the <a href= "http://htmlpurifier.org/docs/enduser-customize.html">advanced customization features.</a> </p> <p> <strong>Warning:</strong> If another directive conflicts with the elements here, <em>that</em> directive will win and override. </p> </div> </div> <div class="directive"> <h3 id="HTML.AllowedModules"> HTML.AllowedModules </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 241 </li> </ul> </td> </tr> </table> <div class="description"> <p> A doctype comes with a set of usual modules to use. Without having to mucking about with the doctypes, you can quickly activate or disable these modules by specifying which modules you wish to allow with this directive. This is most useful for unit testing specific modules, although end users may find it useful for their own ends. </p> <p> If you specify a module that does not exist, the manager will silently fail to use it, so be careful! User-defined modules are not affected by this directive. Modules defined in <a href= "#HTML.CoreModules">%HTML.CoreModules</a> are not affected by this directive. </p> </div> </div> <div class="directive"> <h3 id="HTML.Attr.Name.UseCDATA"> HTML.Attr.Name.UseCDATA </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrTransform/Name.php</em> on line 18 </li> <li> <em>HTMLPurifier/HTMLModule/Name.php</em> on line 19 </li> </ul> </td> </tr> </table> <div class="description"> The W3C specification DTD defines the name attribute to be CDATA, not ID, due to limitations of DTD. In certain documents, this relaxed behavior is desired, whether it is to specify duplicate names, or to specify names that would be illegal IDs (for example, names that begin with a digit.) Set this configuration directive to true to use the relaxed parsing rules. </div> </div> <div class="directive"> <h3 id="HTML.BlockWrapper"> HTML.BlockWrapper </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'p'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLDefinition.php</em> on line 263 </li> </ul> </td> </tr> </table> <div class="description"> <p> String name of element to wrap inline elements that are inside a block context. This only occurs in the children of blockquote in strict mode. </p> <p> Example: by default value, <code><blockquote>Foo</blockquote></code> would become <code><blockquote><p>Foo</p></blockquote></code>. The <code><p></code> tags can be replaced with whatever you desire, as long as it is a block level element. </p> </div> </div> <div class="directive"> <h3 id="HTML.CoreModules"> HTML.CoreModules </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array ( 'Structure' => true, 'Text' => true, 'Hypertext' => true, 'List' => true, 'NonXMLCommonAttributes' => true, 'XMLCommonAttributes' => true, 'CommonAttributes' => true, )</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 242 </li> </ul> </td> </tr> </table> <div class="description"> <p> Certain modularized doctypes (XHTML, namely), have certain modules that must be included for the doctype to be an conforming document type: put those modules here. By default, XHTML's core modules are used. You can set this to a blank array to disable core module protection, but this is not recommended. </p> </div> </div> <div class="directive"> <h3 id="HTML.CustomDoctype"> HTML.CustomDoctype </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/DoctypeRegistry.php</em> on line 123 </li> </ul> </td> </tr> </table> <div class="description"> A custom doctype for power-users who defined there own document type. This directive only applies when <a href= "#HTML.Doctype">%HTML.Doctype</a> is blank. </div> </div> <div class="directive"> <h3 id="HTML.DefinitionID"> HTML.DefinitionID </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> </table> <div class="description"> <p> Unique identifier for a custom-built HTML definition. If you edit the raw version of the HTMLDefinition, introducing changes that the configuration object does not reflect, you must specify this variable. If you change your custom edits, you should change this directive, or clear your cache. Example: </p> <pre> $config = HTMLPurifier_Config::createDefault(); $config->set('HTML', 'DefinitionID', '1'); $def = $config->getHTMLDefinition(); $def->addAttribute('a', 'tabindex', 'Number'); </pre> <p> In the above example, the configuration is still at the defaults, but using the advanced API, an extra attribute has been added. The configuration object normally has no way of knowing that this change has taken place, so it needs an extra directive: <a href= "#HTML.DefinitionID">%HTML.DefinitionID</a>. If someone else attempts to use the default configuration, these two pieces of code will not clobber each other in the cache, since one has an extra directive attached to it. </p> <p> You <em>must</em> specify a value to this directive to use the advanced API features. </p> </div> </div> <div class="directive"> <h3 id="HTML.DefinitionRev"> HTML.DefinitionRev </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-int"> <a href="#type-int">Integer</a> </td> </tr> <tr> <th> Default </th> <td> <pre>1</pre> </td> </tr> </table> <div class="description"> <p> Revision identifier for your custom definition specified in <a href="#HTML.DefinitionID">%HTML.DefinitionID</a>. This serves the same purpose: uniquely identifying your custom definition, but this one does so in a chronological context: revision 3 is more up-to-date then revision 2. Thus, when this gets incremented, the cache handling is smart enough to clean up any older revisions of your definition as well as flush the cache. </p> </div> </div> <div class="directive"> <h3 id="HTML.Doctype"> HTML.Doctype </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Allowed values </th> <td> "HTML 4.01 Transitional", "HTML 4.01 Strict", "XHTML 1.0 Transitional", "XHTML 1.0 Strict", "XHTML 1.1" </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/DoctypeRegistry.php</em> on line 119 </li> </ul> </td> </tr> </table> <div class="description"> Doctype to use during filtering. Technically speaking this is not actually a doctype (as it does not identify a corresponding DTD), but we are using this name for sake of simplicity. When non-blank, this will override any older directives like <a href= "#HTML.XHTML">%HTML.XHTML</a> or <a href= "#HTML.Strict">%HTML.Strict</a>. </div> </div> <div class="directive"> <h3 id="HTML.FlashAllowFullScreen"> HTML.FlashAllowFullScreen </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrTransform/SafeParam.php</em> on line 53 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to permit embedded Flash content from <a href= "#HTML.SafeObject">%HTML.SafeObject</a> to expand to the full screen. Corresponds to the <code>allowFullScreen</code> parameter. </p> </div> </div> <div class="directive"> <h3 id="HTML.ForbiddenAttributes"> HTML.ForbiddenAttributes </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLDefinition.php</em> on line 400 </li> </ul> </td> </tr> </table> <div class="description"> <p> While this directive is similar to <a href= "#HTML.AllowedAttributes">%HTML.AllowedAttributes</a>, for forwards-compatibility with XML, this attribute has a different syntax. Instead of <code>tag.attr</code>, use <code>tag@attr</code>. To disallow <code>href</code> attributes in <code>a</code> tags, set this directive to <code>a@href</code>. You can also disallow an attribute globally with <code>attr</code> or <code>*@attr</code> (either syntax is fine; the latter is provided for consistency with <a href= "#HTML.AllowedAttributes">%HTML.AllowedAttributes</a>). </p> <p> <strong>Warning:</strong> This directive complements <a href= "#HTML.ForbiddenElements">%HTML.ForbiddenElements</a>, accordingly, check out that directive for a discussion of why you should think twice before using this directive. </p> </div> </div> <div class="directive"> <h3 id="HTML.ForbiddenElements"> HTML.ForbiddenElements </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLDefinition.php</em> on line 399 </li> </ul> </td> </tr> </table> <div class="description"> <p> This was, perhaps, the most requested feature ever in HTML Purifier. Please don't abuse it! This is the logical inverse of <a href="#HTML.AllowedElements">%HTML.AllowedElements</a>, and it will override that directive, or any other directive. </p> <p> If possible, <a href="#HTML.Allowed">%HTML.Allowed</a> is recommended over this directive, because it can sometimes be difficult to tell whether or not you've forbidden all of the behavior you would like to disallow. If you forbid <code>img</code> with the expectation of preventing images on your site, you'll be in for a nasty surprise when people start using the <code>background-image</code> CSS property. </p> </div> </div> <div class="directive"> <h3 id="HTML.MaxImgLength"> HTML.MaxImgLength </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.1 </td> </tr> <tr> <th> Type </th> <td class="type type-int"> <a href="#type-int">Integer (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>1200</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModule/Image.php</em> on line 21 </li> <li> <em>HTMLPurifier/HTMLModule/SafeEmbed.php</em> on line 18 </li> <li> <em>HTMLPurifier/HTMLModule/SafeObject.php</em> on line 24 </li> </ul> </td> </tr> </table> <div class="description"> <p> This directive controls the maximum number of pixels in the width and height attributes in <code>img</code> tags. This is in place to prevent imagecrash attacks, disable with null at your own risk. This directive is similar to <a href= "#CSS.MaxImgLength">%CSS.MaxImgLength</a>, and both should be concurrently edited, although there are subtle differences in the input format (the HTML max is an integer). </p> </div> </div> <div class="directive"> <h3 id="HTML.Nofollow"> HTML.Nofollow </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 268 </li> </ul> </td> </tr> </table> <div class="description"> If enabled, nofollow rel attributes are added to all outgoing links. </div> </div> <div class="directive"> <h3 id="HTML.Parent"> HTML.Parent </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'div'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLDefinition.php</em> on line 273 </li> </ul> </td> </tr> </table> <div class="description"> <p> String name of element that HTML fragment passed to library will be inserted in. An interesting variation would be using span as the parent element, meaning that only inline tags would be allowed. </p> </div> </div> <div class="directive"> <h3 id="HTML.Proprietary"> HTML.Proprietary </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 256 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to allow proprietary elements and attributes in your documents, as per <code>HTMLPurifier_HTMLModule_Proprietary</code>. <strong>Warning:</strong> This can cause your documents to stop validating! </p> </div> </div> <div class="directive"> <h3 id="HTML.SafeEmbed"> HTML.SafeEmbed </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 262 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to permit embed tags in documents, with a number of extra security features added to prevent script execution. This is similar to what websites like MySpace do to embed tags. Embed is a proprietary element and will cause your website to stop validating; you should see if you can use <a href= "#Output.FlashCompat">%Output.FlashCompat</a> with <a href= "#HTML.SafeObject">%HTML.SafeObject</a> instead first. </p> </div> </div> <div class="directive"> <h3 id="HTML.SafeIframe"> HTML.SafeIframe </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.4.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModule/Iframe.php</em> on line 28 </li> <li> <em>HTMLPurifier/URIFilter/SafeIframe.php</em> on line 48 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to permit iframe tags in untrusted documents. This directive must be accompanied by a whitelist of permitted iframes, such as <a href= "#URI.SafeIframeRegexp">%URI.SafeIframeRegexp</a>, otherwise it will fatally error. This directive has no effect on strict doctypes, as iframes are not valid. </p> </div> </div> <div class="directive"> <h3 id="HTML.SafeObject"> HTML.SafeObject </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 259 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to permit object tags in documents, with a number of extra security features added to prevent script execution. This is similar to what websites like MySpace do to object tags. You should also enable <a href= "#Output.FlashCompat">%Output.FlashCompat</a> in order to generate Internet Explorer compatibility code for your object tags. </p> </div> </div> <div class="directive"> <h3 id="HTML.SafeScripting"> HTML.SafeScripting </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.5.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 265 </li> <li> <em>HTMLPurifier/HTMLModule/SafeScripting.php</em> on line 22 </li> </ul> </td> </tr> </table> <div class="description"> <p> Whether or not to permit script tags to external scripts in documents. Inline scripting is not allowed, and the script must match an explicit whitelist. </p> </div> </div> <div class="directive deprecated"> <h3 id="HTML.Strict"> HTML.Strict </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/DoctypeRegistry.php</em> on line 133 </li> </ul> </td> </tr> </table> <div class="deprecated-notice"> <strong>Warning:</strong> This directive was deprecated in version 1.7.0. <a href="#HTML.Doctype">%HTML.Doctype</a> should be used instead. </div> <div class="description"> Determines whether or not to use Transitional (loose) or Strict rulesets. </div> </div> <div class="directive"> <h3 id="HTML.TargetBlank"> HTML.TargetBlank </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.4.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 271 </li> </ul> </td> </tr> </table> <div class="description"> If enabled, <code>target=blank</code> attributes are added to all outgoing links. (This includes links from an HTTPS version of a page to an HTTP version.) </div> </div> <div class="directive"> <h3 id="HTML.TidyAdd"> HTML.TidyAdd </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModule/Tidy.php</em> on line 54 </li> </ul> </td> </tr> </table> <div class="description"> Fixes to add to the default set of Tidy fixes as per your level. </div> </div> <div class="directive"> <h3 id="HTML.TidyLevel"> HTML.TidyLevel </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Allowed values </th> <td> "none", "light", "medium", "heavy" </td> </tr> <tr> <th> Default </th> <td> <pre>'medium'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModule/Tidy.php</em> on line 50 </li> </ul> </td> </tr> </table> <div class="description"> <p> General level of cleanliness the Tidy module should enforce. There are four allowed values: </p> <dl> <dt> none </dt> <dd> No extra tidying should be done </dd> <dt> light </dt> <dd> Only fix elements that would be discarded otherwise due to lack of support in doctype </dd> <dt> medium </dt> <dd> Enforce best practices </dd> <dt> heavy </dt> <dd> Transform all deprecated elements and attributes to standards compliant equivalents </dd> </dl> </div> </div> <div class="directive"> <h3 id="HTML.TidyRemove"> HTML.TidyRemove </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModule/Tidy.php</em> on line 55 </li> </ul> </td> </tr> </table> <div class="description"> Fixes to remove from the default set of Tidy fixes as per your level. </div> </div> <div class="directive"> <h3 id="HTML.Trusted"> HTML.Trusted </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/HTMLModuleManager.php</em> on line 234 </li> <li> <em>HTMLPurifier/Lexer.php</em> on line 302 </li> <li> <em>HTMLPurifier/HTMLModule/Image.php</em> on line 37 </li> <li> <em>HTMLPurifier/Lexer/DirectLex.php</em> on line 47 </li> <li> <em>HTMLPurifier/Strategy/RemoveForeignElements.php</em> on line 30 </li> </ul> </td> </tr> </table> <div class="description"> Indicates whether or not the user input is trusted or not. If the input is trusted, a more expansive set of allowed tags and attributes will be used. See also <a href= "#CSS.Trusted">%CSS.Trusted</a>. </div> </div> <div class="directive deprecated"> <a id="Core.XHTML" name="Core.XHTML"></a> <h3 id="HTML.XHTML"> HTML.XHTML </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Aliases </th> <td> Core.XHTML </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/DoctypeRegistry.php</em> on line 128 </li> </ul> </td> </tr> </table> <div class="deprecated-notice"> <strong>Warning:</strong> This directive was deprecated in version 1.7.0. <a href="#HTML.Doctype">%HTML.Doctype</a> should be used instead. </div> <div class="description"> Determines whether or not output is XHTML 1.0 or HTML 4.01 flavor. </div> </div> </div> <div class="namespace"> <h2 id="Output"> Output </h2> <div class="directive"> <a id="Core.CommentScriptContents" name= "Core.CommentScriptContents"></a> <h3 id="Output.CommentScriptContents"> Output.CommentScriptContents </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Aliases </th> <td> Core.CommentScriptContents </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Generator.php</em> on line 70 </li> </ul> </td> </tr> </table> <div class="description"> Determines whether or not HTML Purifier should attempt to fix up the contents of script tags for legacy browsers with comments. </div> </div> <div class="directive"> <h3 id="Output.FixInnerHTML"> Output.FixInnerHTML </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Generator.php</em> on line 71 </li> </ul> </td> </tr> </table> <div class="description"> <p> If true, HTML Purifier will protect against Internet Explorer's mishandling of the <code>innerHTML</code> attribute by appending a space to any attribute that does not contain angled brackets, spaces or quotes, but contains a backtick. This slightly changes the semantics of any given attribute, so if this is unacceptable and you do not use <code>innerHTML</code> on any of your pages, you can turn this directive off. </p> </div> </div> <div class="directive"> <h3 id="Output.FlashCompat"> Output.FlashCompat </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Generator.php</em> on line 73 </li> </ul> </td> </tr> </table> <div class="description"> <p> If true, HTML Purifier will generate Internet Explorer compatibility code for all object code. This is highly recommended if you enable <a href= "#HTML.SafeObject">%HTML.SafeObject</a>. </p> </div> </div> <div class="directive"> <h3 id="Output.Newline"> Output.Newline </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.0.1 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Generator.php</em> on line 123 </li> </ul> </td> </tr> </table> <div class="description"> <p> Newline string to format final output with. If left null, HTML Purifier will auto-detect the default newline type of the system and use that; you can manually override it here. Remember, \r\n is Windows, \r is Mac, and \n is Unix. </p> </div> </div> <div class="directive"> <h3 id="Output.SortAttr"> Output.SortAttr </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Generator.php</em> on line 72 </li> </ul> </td> </tr> </table> <div class="description"> <p> If true, HTML Purifier will sort attributes by name before writing them back to the document, converting a tag like: <code><el b="" a="" c="" /></code> to <code><el a="" b="" c="" /></code>. This is a workaround for a bug in FCKeditor which causes it to swap attributes order, adding noise to text diffs. If you're not seeing this bug, chances are, you don't need this directive. </p> </div> </div> <div class="directive"> <a id="Core.TidyFormat" name="Core.TidyFormat"></a> <h3 id="Output.TidyFormat"> Output.TidyFormat </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.1.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Aliases </th> <td> Core.TidyFormat </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Generator.php</em> on line 104 </li> </ul> </td> </tr> </table> <div class="description"> <p> Determines whether or not to run Tidy on the final output for pretty formatting reasons, such as indentation and wrap. </p> <p> This can greatly improve readability for editors who are hand-editing the HTML, but is by no means necessary as HTML Purifier has already fixed all major errors the HTML may have had. Tidy is a non-default extension, and this directive will silently fail if Tidy is not available. </p> <p> If you are looking to make the overall look of your page's source better, I recommend running Tidy on the entire page rather than just user-content (after all, the indentation relative to the containing blocks will be incorrect). </p> </div> </div> </div> <div class="namespace"> <h2 id="Test"> Test </h2> <div class="directive"> <h3 id="Test.ForceNoIconv"> Test.ForceNoIconv </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/Encoder.php</em> on lines 382, 433 </li> </ul> </td> </tr> </table> <div class="description"> When set to true, HTMLPurifier_Encoder will act as if iconv does not exist and use only pure PHP implementations. </div> </div> </div> <div class="namespace"> <h2 id="URI"> URI </h2> <div class="directive"> <h3 id="URI.AllowedSchemes"> URI.AllowedSchemes </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-lookup"> <a href="#type-lookup">Lookup array</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array ( 'http' => true, 'https' => true, 'mailto' => true, 'ftp' => true, 'nntp' => true, 'news' => true, )</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URISchemeRegistry.php</em> on line 48 </li> </ul> </td> </tr> </table> <div class="description"> Whitelist that defines the schemes that a URI is allowed to have. This prevents XSS attacks from using pseudo-schemes like javascript or mocha. There is also support for the <code>data</code> and <code>file</code> URI schemes, but they are not enabled by default. </div> </div> <div class="directive"> <h3 id="URI.Base"> URI.Base </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URIDefinition.php</em> on line 77 </li> </ul> </td> </tr> </table> <div class="description"> <p> The base URI is the URI of the document this purified HTML will be inserted into. This information is important if HTML Purifier needs to calculate absolute URIs from relative URIs, such as when <a href="#URI.MakeAbsolute">%URI.MakeAbsolute</a> is on. You may use a non-absolute URI for this value, but behavior may vary (<a href="#URI.MakeAbsolute">%URI.MakeAbsolute</a> deals nicely with both absolute and relative paths, but forwards-compatibility is not guaranteed). <strong>Warning:</strong> If set, the scheme on this URI overrides the one specified by <a href= "#URI.DefaultScheme">%URI.DefaultScheme</a>. </p> </div> </div> <div class="directive"> <h3 id="URI.DefaultScheme"> URI.DefaultScheme </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String</a> </td> </tr> <tr> <th> Default </th> <td> <pre>'http'</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URIDefinition.php</em> on line 84 </li> </ul> </td> </tr> </table> <div class="description"> <p> Defines through what scheme the output will be served, in order to select the proper object validator when no scheme information is present. </p> </div> </div> <div class="directive"> <h3 id="URI.DefinitionID"> URI.DefinitionID </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> </table> <div class="description"> <p> Unique identifier for a custom-built URI definition. If you want to add custom URIFilters, you must specify this value. </p> </div> </div> <div class="directive"> <h3 id="URI.DefinitionRev"> URI.DefinitionRev </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-int"> <a href="#type-int">Integer</a> </td> </tr> <tr> <th> Default </th> <td> <pre>1</pre> </td> </tr> </table> <div class="description"> <p> Revision identifier for your custom definition. See <a href= "#HTML.DefinitionRev">%HTML.DefinitionRev</a> for details. </p> </div> </div> <div class="directive"> <a id="Attr.DisableURI" name="Attr.DisableURI"></a> <h3 id="URI.Disable"> URI.Disable </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Aliases </th> <td> Attr.DisableURI </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/AttrDef/URI.php</em> on line 47 </li> </ul> </td> </tr> </table> <div class="description"> <p> Disables all URIs in all forms. Not sure why you'd want to do that (after all, the Internet's founded on the notion of a hyperlink). </p> </div> </div> <div class="directive"> <h3 id="URI.DisableExternal"> URI.DisableExternal </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> Disables links to external websites. This is a highly effective anti-spam and anti-pagerank-leech measure, but comes at a hefty price: nolinks or images outside of your domain will be allowed. Non-linkified URIs will still be preserved. If you want to be able to link to subdomains or use absolute URIs, specify <a href= "#URI.Host">%URI.Host</a> for your website. </div> </div> <div class="directive"> <h3 id="URI.DisableExternalResources"> URI.DisableExternalResources </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> Disables the embedding of external resources, preventing users from embedding things like images from other hosts. This prevents access tracking (good for email viewers), bandwidth leeching, cross-site request forging, goatse.cx posting, and other nasties, but also results in a loss of end-user functionality (they can't directly post a pic they posted from Flickr anymore). Use it if you don't have a robust user-content moderation team. </div> </div> <div class="directive"> <h3 id="URI.DisableResources"> URI.DisableResources </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> Disables embedding resources, essentially meaning no pictures. You can still link to them though. See <a href= "#URI.DisableExternalResources">%URI.DisableExternalResources</a> for why this might be a good idea. </p> <p> <em>Note:</em> While this directive has been available since 1.3.0, it didn't actually start doing anything until 4.2.0. </p> </div> </div> <div class="directive"> <h3 id="URI.Host"> URI.Host </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.2.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URIDefinition.php</em> on line 76 </li> <li> <em>HTMLPurifier/URIScheme.php</em> on line 89 </li> </ul> </td> </tr> </table> <div class="description"> <p> Defines the domain name of the server, so we can determine whether or an absolute URI is from your website or not. Not strictly necessary, as users should be using relative URIs to reference resources on your website. It will, however, let you use absolute URIs to link to subdomains of the domain you post here: i.e. example.com will allow sub.example.com. However, higher up domains will still be excluded: if you set <a href= "#URI.Host">%URI.Host</a> to sub.example.com, example.com will be blocked. <strong>Note:</strong> This directive overrides <a href= "#URI.Base">%URI.Base</a> because a given page may be on a sub-domain, but you wish HTML Purifier to be more relaxed and allow some of the parent domains too. </p> </div> </div> <div class="directive"> <h3 id="URI.HostBlacklist"> URI.HostBlacklist </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-list"> <a href="#type-list">Array list</a> </td> </tr> <tr> <th> Default </th> <td> <pre>array()</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URIFilter/HostBlacklist.php</em> on line 25 </li> </ul> </td> </tr> </table> <div class="description"> List of strings that are forbidden in the host of any URI. Use it to kill domain names of spam, etc. Note that it will catch anything in the domain, so <tt>moo.com</tt> will catch <tt>moo.com.example.com</tt>. </div> </div> <div class="directive"> <h3 id="URI.MakeAbsolute"> URI.MakeAbsolute </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 2.1.0 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> </table> <div class="description"> <p> Converts all URIs into absolute forms. This is useful when the HTML being filtered assumes a specific base path, but will actually be viewed in a different context (and setting an alternate base URI is not possible). <a href= "#URI.Base">%URI.Base</a> must be set for this directive to work. </p> </div> </div> <div class="directive"> <h3 id="URI.Munge"> URI.Munge </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 1.3.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> </table> <div class="description"> <p> Munges all browsable (usually http, https and ftp) absolute URIs into another URI, usually a URI redirection service. This directive accepts a URI, formatted with a <code>%s</code> where the url-encoded original URI should be inserted (sample: <code>http://www.google.com/url?q=%s</code>). </p> <p> Uses for this directive: </p> <ul> <li>Prevent PageRank leaks, while being fairly transparent to users (you may also want to add some client side JavaScript to override the text in the statusbar). <strong>Notice</strong>: Many security experts believe that this form of protection does not deter spam-bots. </li> <li>Redirect users to a splash page telling them they are leaving your website. While this is poor usability practice, it is often mandated in corporate environments. </li> </ul> <p> Prior to HTML Purifier 3.1.1, this directive also enabled the munging of browsable external resources, which could break things if your redirection script was a splash page or used <code>meta</code> tags. To revert to previous behavior, please use <a href="#URI.MungeResources">%URI.MungeResources</a>. </p> <p> You may want to also use <a href= "#URI.MungeSecretKey">%URI.MungeSecretKey</a> along with this directive in order to enforce what URIs your redirector script allows. Open redirector scripts can be a security risk and negatively affect the reputation of your domain name. </p> <p> Starting with HTML Purifier 3.1.1, there is also these substitutions: </p> <table> <thead> <tr> <th> Key </th> <th> Description </th> <th> Example <code><a href=""></code> </th> </tr> </thead> <tbody> <tr> <td> %r </td> <td> 1 - The URI embeds a resource<br /> (blank) - The URI is merely a link </td> <td></td> </tr> <tr> <td> %n </td> <td> The name of the tag this URI came from </td> <td> a </td> </tr> <tr> <td> %m </td> <td> The name of the attribute this URI came from </td> <td> href </td> </tr> <tr> <td> %p </td> <td> The name of the CSS property this URI came from, or blank if irrelevant </td> <td></td> </tr> </tbody> </table> <p> Admittedly, these letters are somewhat arbitrary; the only stipulation was that they couldn't be a through f. r is for resource (I would have preferred e, but you take what you can get), n is for name, m was picked because it came after n (and I couldn't use a), p is for property. </p> </div> </div> <div class="directive"> <h3 id="URI.MungeResources"> URI.MungeResources </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.1 </td> </tr> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>false</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URIFilter/Munge.php</em> on line 48 </li> </ul> </td> </tr> </table> <div class="description"> <p> If true, any URI munging directives like <a href= "#URI.Munge">%URI.Munge</a> will also apply to embedded resources, such as <code><img src=""></code>. Be careful enabling this directive if you have a redirector script that does not use the <code>Location</code> HTTP header; all of your images and other embedded resources will break. </p> <p> <strong>Warning:</strong> It is strongly advised you use this in conjunction <a href="#URI.MungeSecretKey">%URI.MungeSecretKey</a> to mitigate the security risk of an open redirector. </p> </div> </div> <div class="directive"> <h3 id="URI.MungeSecretKey"> URI.MungeSecretKey </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 3.1.1 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URIFilter/Munge.php</em> on line 49 </li> </ul> </td> </tr> </table> <div class="description"> <p> This directive enables secure checksum generation along with <a href="#URI.Munge">%URI.Munge</a>. It should be set to a secure key that is not shared with anyone else. The checksum can be placed in the URI using %t. Use of this checksum affords an additional level of protection by allowing a redirector to check if a URI has passed through HTML Purifier with this line: </p> <pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre> <p> If the output is TRUE, the redirector script should accept the URI. </p> <p> Please note that it would still be possible for an attacker to procure secure hashes en-mass by abusing your website's Preview feature or the like, but this service affords an additional level of protection that should be combined with website blacklisting. </p> <p> Remember this has no effect if <a href= "#URI.Munge">%URI.Munge</a> is not on. </p> </div> </div> <div class="directive"> <h3 id="URI.OverrideAllowedSchemes"> URI.OverrideAllowedSchemes </h3> <table class="constraints"> <tr> <th> Type </th> <td class="type type-bool"> <a href="#type-bool">Boolean</a> </td> </tr> <tr> <th> Default </th> <td> <pre>true</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URISchemeRegistry.php</em> on line 49 </li> </ul> </td> </tr> </table> <div class="description"> If this is set to true (which it is by default), you can override <a href="#URI.AllowedSchemes">%URI.AllowedSchemes</a> by simply registering a HTMLPurifier_URIScheme to the registry. If false, you will also have to update that directive in order to add more schemes. </div> </div> <div class="directive"> <h3 id="URI.SafeIframeRegexp"> URI.SafeIframeRegexp </h3> <table class="constraints"> <tr> <th> Version added </th> <td> 4.4.0 </td> </tr> <tr> <th> Type </th> <td class="type type-string"> <a href="#type-string">String (or null)</a> </td> </tr> <tr> <th> Default </th> <td> <pre>NULL</pre> </td> </tr> <tr> <th> Used in </th> <td> <ul> <li> <em>HTMLPurifier/URIFilter/SafeIframe.php</em> on line 35 </li> </ul> </td> </tr> </table> <div class="description"> <p> A PCRE regular expression that will be matched against an iframe URI. This is a relatively inflexible scheme, but works well enough for the most common use-case of iframes: embedded video. This directive only has an effect if <a href= "#HTML.SafeIframe">%HTML.SafeIframe</a> is enabled. Here are some example values: </p> <ul> <li> <code>%^http://www.youtube.com/embed/%</code> - Allow YouTube videos </li> <li> <code>%^http://player.vimeo.com/video/%</code> - Allow Vimeo videos </li> <li> <code>%^http://(www.youtube.com/embed/|player.vimeo.com/video/)%</code> - Allow both </li> </ul> <p> Note that this directive does not give you enough granularity to, say, disable all <code>autoplay</code> videos. Pipe up on the HTML Purifier forums if this is a capability you want. </p> </div> </div> </div> </div> </body> </html>
💾 Save Changes
Cancel
📤 Upload File
×
Select File
Upload
Cancel
➕ Create New
×
Type
📄 File
📁 Folder
Name
Create
Cancel
✎ Rename Item
×
Current Name
New Name
Rename
Cancel
🔐 Change Permissions
×
Target File
Permission (e.g., 0755, 0644)
0755
0644
0777
Apply
Cancel