Take the 2-minute tour ×

I'm having trouble allowing certain HTML attributes into HTMLPurifier's whitelist.

This is my code:

$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Allowed', 'u,p,b,i,span[style],strike,s,strong,em,li,ul,ol,div[align],br,img[src|alt|width|height],sub,sup');
$purifier = new HTMLPurifier($config);

When I run: $clean_str = $purifier->purify($dirty_str); on this: <div align="left">Left</div> I get this: <div>left</div>.

If I remove: div[align] from HTML.Allowed I get this: Left - so I know that the HTML.Allowed is working for elements, but not for attributes.

I'm sure I'm doing something silly, but I can't for the life of me figure it out!

Thanks in advance for any help.

Using htmlpurifier-4.4.0-lite with PHP 5.3.14

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Turn off magic quotes. See the manual: http://php.net/manual/en/security.magicquotes.disabling.php

share|improve this answer
@edward-z-yang If it run phpinfo(), it looks like magic quotes are already off: magic_quotes_gpc: Off, magic_quotes_runtime: Off, magic_quotes_sybase: Off Or is there another place I need to check to see if it is set to on? Thanks –  SammyBlackBaron Nov 13 '12 at 11:18
Are you MySQL escaping the string before passing it to HTML Purifier? What does it look like before you pass it to HTML Purifier? –  Edward Z. Yang Nov 14 '12 at 4:02
That was it - my quotes were being escaped before being passed to HTML Purifier. I can't believe I missed it, but thanks so much for the help. –  SammyBlackBaron Nov 14 '12 at 11:13

Your Answer


