What are the differences between the built-in php method htmlspecialchars() and htmlpurifier library?
If you just want to stop any HTML from being used, use htmlspecialchars
or htmlentities
.
HTML Purifier is intended to let you allow some HTML, with quite a few options - for example, you can allow video embeds only from YouTube, or allow only certain CSS classes on certain HTML tags. Handy if you're building a CMS or something where you want to allow people to use HTML but not permit malicious use.
It can also make HTML fixes, like adding default alt
tags to images, cleanup of invalid or unnecessary code, etc.
Peruse the available configuration options for an idea of what's possible.