Sanitizer

The Sanitizer interface of the HTML Sanitizer API allows developers to take untrusted strings of HTML, and sanitize them for safe insertion into a document’s DOM.

Constructors

Sanitizer.Sanitizer

Creates and returns a Sanitizer object.

Methods

Sanitizer.sanitizeToString()

Returns a sanitized String from an input, removing any offending elements or attributes.

Sanitizer.sanitize()

Returns a sanitized DocumentFragment from an input, removing any offending elements or attributes.

Examples

This example shows the result of sanitizing a string using the Sanitizer.sanitizeToString() method. Disallowed script and blink elements are removed from the input.

// our input string to clean
const stringToClean = 'Some text <b><i>with</i></b> <blink>tags</blink>, including a rogue script <script>alert(1)</script> def.';

const result = new Sanitizer().sanitizeToString(stringToClean);
console.log(result);
// Logs: "Some text <b><i>with</i></b> <blink>tags</blink>, including a rogue script def."

Specifications

Browser compatibility