Safely filter XSS attack code, dangerous tags and attributes with whitelist mode
Zero Dependencies · Works OfflineThe HTML Sanitizer is an online security tool for filtering potentially dangerous content from HTML code. It removes XSS attack vectors (script tags, event handler attributes, javascript: protocols) while preserving safe HTML tags and attributes, ensuring user-submitted HTML content can be safely displayed.
Sanitize user-submitted HTML content before display to prevent XSS attacks and protect website and user security.
Filter HTML output from rich text editors to ensure only safe formatting tags are preserved.
Analyze HTML code for potential security risks and identify attack vectors that could be exploited.
XSS (Cross-Site Scripting) is one of the most common web security vulnerabilities. Attackers inject malicious scripts into web pages to steal user cookies, session tokens, or even control user browsers. HTML sanitization is an important defense against XSS, blocking script execution paths by removing dangerous HTML elements and attributes. OWASP recommends using whitelist-based HTML sanitization, as blacklist approaches can easily miss new attack techniques.
HTML sanitization is the process of filtering potentially dangerous content from HTML code, including removing script tags, event handler attributes, javascript: protocol links and other XSS attack vectors, while preserving safe HTML tags and attributes.
When user-submitted HTML content needs to be displayed on a page, unsanitized HTML may contain malicious scripts leading to XSS attacks. HTML sanitization prevents script injection and protects user data security.
Whitelist mode only allows specified safe tags and attributes through, removing everything else - higher security. Blacklist mode only removes specified dangerous tags and attributes, keeping everything else - more flexible but less secure.
Dangerous tags include: script, iframe, object, embed, applet, form, input, meta, link, base. Dangerous attributes include: all on* event attributes, javascript: protocol, data: protocol, expression() in style.
Whitelist-mode sanitized HTML is safe in most scenarios, but no 100% guarantee exists. Use together with CSP (Content Security Policy) and regularly update whitelist rules.