<?php
require_once 'htmlpurifier/HTMLPurifier.auto.php';

$config = HTMLPurifier_Config::createDefault();
$config->set('Core.Encoding', 'UTF-8'); // مهم للتأكد من التعرف على الأحرف
$config->set('HTML.Allowed', 'b,i,u,a[href|target|rel],span[style],font[color|size|face]');
$config->set('CSS.AllowedProperties', 'color,font-size,font-weight,text-decoration');
$config->set('URI.AllowedSchemes', array( 'https' => true));
$config->set('Attr.AllowedFrameTargets', array('_blank')); // للسماح بـ target="_blank"

$purifier = new HTMLPurifier($config);

$var = "Hello <b>World</b>! <script>alert('XSS');</script>
Click <a href=\"javascript:alert('XSS')\" target=\"_blank\">here</a>!
<span style=\"color:red; font-size:16px; background-image:url(javascript:alert('XSS'))\">Important</span>
<font color=\"blue\" size=\"5\" face=\"Arial\" onclick=\"alert('XSS')\">Text</font>";
$var = $purifier->purify($var);
echo $var;

?>