I cannot figure how to use HTMLPurifier (ezyang/htmlpurifier) out of the box.
Here is an example where I cannot keep the align attribute in the output.

$config = HTMLPurifier_Config::createDefault();
$config->set("HTML.Allowed", "img[src|align|alt]");
$purifier = new HTMLPurifier($config);

$input='<img src="https://www.toto.com/image.png" align="center" alt="descriptive text" data-author="random" onload="javascript:xss()">';
$output = $purifier->purify($input);

echo HTMLPurifier::VERSION . "n";
echo "input = " . $input . "n";
echo "output = " . $output . "n";

/*
    4.17.0
    input = <img src="https://www.toto.com/image.png" align="center" alt="descriptive text" data-author="random" onload="javascript:xss()">
    output = <img src="https://www.toto.com/image.png" alt="descriptive text" />
*/

Whatever I try from the docs (like using HTML.AllowedElements & HTML.AllowedAttributes instead of the single HTML.Allowed), I cannot figure out to configure HTMLPurifier for my needs. I am probably missing something obvious but I cannot figure what 😮