中文
devexamples

HTML Escape And Sanitize Input

Escape HTML special characters and strip dangerous tags from user input to prevent XSS in server-rendered templates.

JavascriptSecurity Boundaries

Code

snippet
export function escapeHtml(str){return String(str).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');}export function sanitizeHtml(html,{allowedTags=['b','i','em','strong','a','p','br']}={}){return escapeHtml(html).replace(/&lt;\/?([a-z0-9]+)\b[^&]*&gt;/gi,(full,tag)=>allowedTags.includes(tag.toLowerCase())?full.replace(/&lt;/g,'<').replace(/&gt;/g,'>'):'');}

Related Examples