<?php



namespace App\Support;



/**

 * Minimal sanitization for rich text from Quill (no external API).

 * Allows common formatting tags; strips scripts and event handlers.

 */

class NewsContentSanitizer

{

    public static function sanitize(?string $html): string

    {

        if ($html === null || $html === '') {

            return '';

        }



        // Remove script/style blocks

        $html = preg_replace('#<(script|style)\b[^>]*>.*?</\1>#is', '', $html) ?? '';

        // Strip common inline event handlers (onclick=, onerror=, ...)

        $html = preg_replace('#\s+on\w+\s*=\s*("|\')[^"\']*\1#i', '', $html) ?? '';

        $html = preg_replace('#\s+on\w+\s*=\s*[^\s>]+#i', '', $html) ?? '';



        // Allow only tags produced by our Quill toolbar (no links/images to avoid href XSS)

        $allowed = '<p><br><strong><b><em><i><u><s><h1><h2><h3><h4><ul><ol><li><blockquote>';



        return trim(strip_tags($html, $allowed));

    }

}

