Sanitizer

Purpose

The single chokepoint for normalising untrusted input on the frontend. Routes user-submitted strings through iManager's Validation\Sanitizer and adds two legacy helpers (templateName(), pageName()) that the bundled themes still call. Themes reach it as $site->sanitizer; action handlers run every $_POST value through it before storing or echoing.

No method on this class throws. Invalid input collapses to the empty string (or null for email()) so callers can pipe with ?? and stay readable.

FQCN + file path

When to use

You touch the sanitizer in three places:

  • Action handler parsing a $_POST body before storing or displaying it. $this->sanitizer->text($this->input->post('subject', '')).
  • Template echoing a value that came in over the wire (a query param, a referrer, a flash arg). $this->sanitizer->entities($value) for inline display; markdown() for body content.
  • Internal helper computing a derived value like a slug from a page name.

You do not need to sanitize values that came out of the page repository: those went through the editor's own validation on save. Sanitization is for user input.

Surface

public function text(string $value, int $maxLength = 255): string

Single-line plain text. Strips control characters and HTML, trims to $maxLength. Use for form fields that should not contain newlines (a subject, a name, a label).

public function multiline(string $value, int $maxLength = 65535): string

Multi-line plain text. Preserves newlines, otherwise behaves like text(). Use for message bodies, comments, anything you would render inside <pre> or via nl2br().

public function slug(string $value, int $maxLength = 128): string

URL-safe slug. Lowercases, replaces whitespace and special characters with -, collapses consecutive separators, trims to $maxLength. Use when deriving a slug from a human-readable title.

public function pageName(string $value): string

Legacy alias for slug() (no length parameter). Kept because older theme code reads more naturally as pageName($entry->name) when computing a URL fragment for a page. New code can prefer slug().

public function templateName(string $value): string

Filename-safe template name. Strips anything outside [a-zA-Z0-9_\-/]. Use when a template name comes from user input (frontmatter, query param, etc.) and you are about to feed it to include.

public function email(string $value): ?string

PHP FILTER_VALIDATE_EMAIL. Returns the normalised address on success, null on failure. The ?string return makes the failure case explicit:

$email = $site->sanitizer->email($site->input->post('email', ''));
if ($email === null) {
    $site->addMsg('error', 'Please enter a valid email address.');
    return;
}

public function url(string $value): string

URL with scheme + host validation. Returns the normalised URL or the empty string (note: not null, unlike email()). Reject empty results before using.

public function entities(string $value): string

htmlspecialchars(..., ENT_QUOTES | ENT_HTML5, 'UTF-8') shorthand. Use when echoing a string into HTML attribute or text content where Markdown is not expected.

public function markdown(string $value): string

Renders CommonMark in safe mode: embedded HTML is escaped, non-allowlisted URL schemes (javascript:, data:, vbscript:, etc.) are rejected. Used internally by Site::renderContent() to produce the default $site->page->content rendering. Theme code that wants Markdown rendering for a custom field calls this directly.

Lifecycle

final readonly. Constructed once by Site::__construct(), wrapping the container-bound Imanager\Validation\Sanitizer. Shared across the request; safe to inject anywhere.

The class is a façade with no internal state, so calls are pure functions of their arguments. No need to memoise; no thread or context concerns.

Common patterns

Sanitizing a contact form

public function contactAction(): void
{
    if ($this->input->method() !== 'POST') {
        return;
    }
    $name    = $this->sanitizer->text($this->input->post('name', ''));
    $email   = $this->sanitizer->email($this->input->post('email', ''));
    $message = $this->sanitizer->multiline($this->input->post('message', ''));

    if ($name === '' || $email === null || $message === '') {
        $this->addMsg('error', 'All fields are required.');
        return;
    }
    // … store, send mail, redirect …
}

Echoing a query param into HTML

<p>You searched for:
   <em><?= $site->sanitizer->entities($site->input->get('q', '')) ?></em>
</p>

Rendering a custom Markdown field

<aside class="excerpt">
    <?= $site->sanitizer->markdown($site->page->excerpt ?? '') ?>
</aside>

See also