sanitize_html - Twig Filter

Contao overrides Symfony’s default sanitize_html filter in order to also sanitize Contao-specific special characters like insert tags.

Default sanitizer

The default sanitizer is configured in framework.html_sanitizer.sanitizer.default and allows all “safe” elements and attributes, as defined by the W3C Standard Proposal. You can find more information about it in the Symfony documentation.

{{ '<div title=test style=color:red onclick=alert(1)><script>alert(2)</script>{{date::Y}}'|sanitize_html }}
{# Output: #} <div title="test">&#123;&#123;date::Y&#125;&#125;</div>

Contao sanitizer

If you use the filter with the 'contao' sanitizer the HTML code is sanitized according to the rules configured in the security section in the Contao system settings. Insert tags do not get encoded and unclosed tags do not get automatically closed in this case.

{{ '<div title=test style=color:red onclick=alert(1)><script>alert(2)</script>{{date::Y}}'|sanitize_html('contao') }}
{# Output: #} <div title="test" style="color:red">&#60;script&#62;alert(2)&#60;/script&#62;{{date::Y}}