Download the PHP package yahyaerturan/minifier without Composer

YahyaErturan Minifier (HTML/JS/CSS, template-aware)

A conservative, production-ready minifier for HTML with embedded CSS/JS and JSON. It’s template-aware (Mustache/Handlebars/Twig-style tokens), safe around </script> landmines, and intentionally avoids risky AST rewrites.

• Zero dependencies, PHP 8.4+
• Template fences: {{ }}, {{{ }}}, {% %}, {# #}, [[ ]] are protected and restored
• Robust <script> handling: finds the real closing tag while skipping strings, comments, template literals, and CDATA
• Sentinel escape: </script> → <\/script> inside JS/JSON to prevent HTML parser bail-outs
• Conservative JS/CSS: strips comments, collapses whitespace safely; preserves /*! … */ and comments with @license/@preserve verbatim
• JSON scripts (application/ld+json): minified via json_decode/json_encode with a safe fallback for not-strictly-valid inputs
• Inline style="" compacted using the same CSS minifier
• Whitespace collapsed outside pre/code/textarea/script/style without stripping inter-tag spaces that can be visually significant (no global >< gluing).

This library is for correctness first. If you want heavy optimization (renaming, dead-code elimination), use a separate build step and keep this as the final safety pass.

Installation

Requires: PHP 8.4+

Quick start

What you get by default:

• HTML comments removed except conditional <!--[if …]> and bang <!--! … -->
• Inline <style> and style="" compacted
• <script> bodies minified for classic JS + modules, </script> escaped
• application/ld+json compacted structurally
• Templating tokens fenced and restored

Ignore controls (escape hatches)

Sometimes a third-party snippet or unusual markup breaks when minified. Use these “do not touch” controls.

HTML directives (comments)

• Region pair:

  • <!-- minify:off --> … <!-- minify:on -->
  • The enclosed region is bypassed entirely (no minification, no sentinel escaping). The control comments themselves are removed.
• One-shot:
  • <!-- minify:ignore-next --> <script>…</script>
  • <!-- minify:ignore-next --> <style>…</style>
  • The very next <script>/<style> is output verbatim; control comment removed.

Per-tag attributes

• On <script> or <style>:
  • data-minify="off" → do not minify the tag body. For <script>, the sentinel escape still applies for safety.
  • data-minify="raw" → output the tag verbatim (no minify, no sentinel escape). Sharp tool; use only when you truly need raw.
• The data-minify attribute is stripped from the output (build hint does not leak).
• Unquoted attributes are supported: type=module, data-minify=off|raw work the same as quoted.

Options

Notes:

• retainScriptSentinel: when a removed JS comment contained </script> (pre-escaped), the minifier emits a tiny placeholder /* <\/script> */. Why: guarantees safety if another tool concatenates content later. Trade-off: a few bytes in rare cases.
• templateDelimiters: longest opener wins; add your own pairs if you use a different templating engine.
• Ignore controls: off keeps <\/script> safety for <script>; raw is truly raw (no safety).

Script handling policy

Goal: Only minify when it’s definitely JavaScript; treat known template types as opaque; always keep </script> safe.

Unquoted attribute support: HTML allows tokens without quotes; this minifier recognizes type=module and data-minify=off|raw even when unquoted.

Why conservative?

Pros: avoids broken pages, keeps template engines happy, plays well with CSP and weird embeds.
Cons: not byte-optimal; doesn’t rewrite semantics or identifiers.
Bottom line: use aggressive tools in CI if you need them; run this as your last line of defense in prod.

Framework integration (sketches)

Laravel middleware:

Symfony kernel response listener:

Safety & security

• CSP: if you hash inline scripts/styles ('sha256-…'), minify before computing hashes.
• XSS: the minifier never unescapes entities or rewrites URLs; it only strips comments and collapses whitespace. It also neutralizes </script> sequences with <\/script> to prevent HTML parser bail-out (unless you request raw).
• Templates: tokens are fenced and restored verbatim. If you use exotic delimiters, add them to templateDelimiters.
• XSS/HTML parser: </script> sequences inside JS/JSON are always neutralized as <\/script>.
• Whitespace: The minifier compresses text nodes but intentionally keeps necessary spaces between HTML tags to avoid layout/text regressions.

Tests & QA

Recommended extras:

• Static analysis (PHPStan/Psalm)
• Mutation testing (Infection)
• Canary & monitor

Known limits (by design)

• No AST-level JS/CSS transforms (no mangling, dead-code removal, or re-ordering).
• No DOM reflow: the HTML pass doesn’t restructure tags or attributes.
• SVG/MathML treated as regular HTML except inside <style> or attributes—safer default.

Versioning

Stable series: 1.0.x (patch releases are backwards-compatible).

License

MIT © Yahya Erturan