![](\"https://raw.githubusercontent.com/apostrophecms/sanitize-html/main/logos/logo-box-madefor.png\"){kind=logo}
\n\nsanitize-html provides a simple HTML sanitizer with a clear API.\n\nsanitize-html is tolerant. It is well suited for cleaning up HTML fragments such as those created by CKEditor and other rich text editors. It is especially handy for removing unwanted CSS when copying and pasting from Word.\n\nsanitize-html allows you to specify the tags you want to permit, and the permitted\nattributes for each of those tags. If an attribute is a known non-boolean value,\nand it is empty, it will be removed. For example `checked` can be empty, but `href`\ncannot.\n\nIf a tag is not permitted, the contents of the tag are not discarded. There are\nsome exceptions to this, discussed below in the \"Discarding the entire contents\nof a disallowed tag\" section.\n\nThe syntax of poorly closed `p` and `img` elements is cleaned up.\n\n`href` attributes are validated to ensure they only contain `http`, `https`, `ftp` and `mailto` URLs. Relative URLs are also allowed. Ditto for `src` attributes.\n\nAllowing particular urls as a `src` to an iframe tag by filtering hostnames is also supported.\n\nHTML comments are not preserved.\nAdditionally, `sanitize-html` escapes _ALL_ text content - this means that ampersands, greater-than, and less-than signs are converted to their equivalent HTML character references (`&` --> `&`, `<` --> `<`, and so on). Additionally, in attribute values, quotation marks are escaped as well (`\"` --> `"`).\n\n## Requirements\n\nsanitize-html is intended for use with Node.js and supports Node 10+. All of its npm dependencies are pure JavaScript. sanitize-html is built on the excellent `htmlparser2` module.\n\n### Regarding TypeScript\n\nsanitize-html is not written in TypeScript and there is no plan to directly support it. There is a community supported typing definition, [`@types/sanitize-html`](https://www.npmjs.com/package/@types/sanitize-html), however.\n```bash\nnpm install -D @types/sanitize-html\n```\nIf `esModuleInterop=true` is not set in your `tsconfig.json` file, you have to import it with:\n\n```javascript\nimport * as sanitizeHtml from 'sanitize-html';\n```\n\nWhen using TypeScript, there is a minimum supported version of >=4.5 because of a dependency on the `htmlparser2` types.\n\nAny questions or problems while using `@types/sanitize-html` should be directed to its maintainers as directed by that project's contribution guidelines.\n\n## How to use\n\n### Browser\n\n*Think first: why do you want to use it in the browser?* Remember, *servers must never trust browsers.* You can't sanitize HTML for saving on the server anywhere else but on the server.\n\nBut, perhaps you'd like to display sanitized HTML immediately in the browser for preview. Or ask the browser to do the sanitization work on every page load. You can if you want to!\n\n* Install the package:\n\n```bash\nnpm install sanitize-html\n```\nor\n```\nyarn add sanitize-html\n```\n\nThe primary change in the 2.x version of sanitize-html is that it no longer includes a build that is ready for browser use. Developers are expected to include sanitize-html in their project builds (e.g., webpack) as they would any other dependency. So while sanitize-html is no longer ready to link to directly in HTML, developers can now more easily process it according to their needs.\n\nOnce built and linked in the browser with other project Javascript, it can be used to sanitize HTML strings in front end code:\n\n```javascript\nimport sanitizeHtml from 'sanitize-html';\n\nconst html = \"hello world\";\nconsole.log(sanitizeHtml(html));\nconsole.log(sanitizeHtml(\"some text...
\n```\n\nWe can do that with the following filter:\n\n```js\nsanitizeHtml(\n 'some text...
',\n {\n textFilter: function(text, tagName) {\n if (['a'].indexOf(tagName) > -1) return //Skip anchor tags\n\n return text.replace(/\\.\\.\\./, '…');\n }\n }\n);\n```\n\nNote that the text passed to the `textFilter` method is already escaped for safe display as HTML. You may add markup and use entity escape sequences in your `textFilter`.\n\n### Iframe Filters\n\nIf you would like to allow iframe tags but want to control the domains that are allowed through, you can provide an array of hostnames and/or array of domains that you would like to allow as iframe sources. This hostname is a property in the options object passed as an argument to the sanitize-html function.\n\nThese arrays will be checked against the html that is passed to the function and return only `src` urls that include the allowed hostnames or domains in the object. The url in the html that is passed must be formatted correctly (valid hostname) as an embedded iframe otherwise the module will strip out the src from the iframe.\n\nMake sure to pass a valid hostname along with the domain you wish to allow, i.e.:\n\n```js\nallowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],\nallowedIframeDomains: ['zoom.us']\n```\n\nYou may also specify whether or not to allow relative URLs as iframe sources.\n\n```js\nallowIframeRelativeUrls: true\n```\n\nNote that if unspecified, relative URLs will be allowed by default if no hostname or domain filter is provided but removed by default if a hostname or domain filter is provided.\n\n**Remember that the `iframe` tag must be allowed as well as the `src` attribute.**\n\nFor example:\n\n```javascript\nconst clean = sanitizeHtml('', {\n allowedTags: [ 'p', 'em', 'strong', 'iframe' ],\n allowedClasses: {\n 'p': [ 'fancy', 'simple' ],\n },\n allowedAttributes: {\n 'iframe': ['src']\n },\n allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']\n});\n```\n\nwill pass through as safe whereas:\n\n```javascript\nconst clean = sanitizeHtml('
', {\n allowedTags: [ 'p', 'em', 'strong', 'iframe' ],\n allowedClasses: {\n 'p': [ 'fancy', 'simple' ],\n },\n allowedAttributes: {\n 'iframe': ['src']\n },\n allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']\n});\n```\n\nor\n\n```javascript\nconst clean = sanitizeHtml('
', {\n allowedTags: [ 'p', 'em', 'strong', 'iframe' ],\n allowedClasses: {\n 'p': [ 'fancy', 'simple' ],\n },\n allowedAttributes: {\n 'iframe': ['src']\n },\n allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com']\n});\n```\n\nwill return an empty iframe tag.\n\nIf you want to allow any subdomain of any level you can provide the domain in `allowedIframeDomains`\n\n```javascript\n// This iframe markup will pass through as safe.\nconst clean = sanitizeHtml('
', {\n allowedTags: [ 'p', 'em', 'strong', 'iframe' ],\n allowedClasses: {\n 'p': [ 'fancy', 'simple' ],\n },\n allowedAttributes: {\n 'iframe': ['src']\n },\n allowedIframeHostnames: ['www.youtube.com', 'player.vimeo.com'],\n allowedIframeDomains: ['zoom.us']\n});\n```\n\n### Script Filters\n\nSimilarly to iframes you can allow a script tag on a list of allowlisted domains\n\n```js\nconst clean = sanitizeHtml('', {\n allowedTags: ['script'],\n allowedAttributes: {\n script: ['src']\n },\n allowedScriptDomains: ['authorized.com'],\n})\n```\n\nYou can allow a script tag on a list of allowlisted hostnames too\n\n```js\nconst clean = sanitizeHtml('', {\n allowedTags: ['script'],\n allowedAttributes: {\n script: ['src']\n },\n allowedScriptHostnames: [ 'www.authorized.com' ],\n})\n```\n\n### Allowed URL schemes\n\nBy default, we allow the following URL schemes in cases where `href`, `src`, etc. are allowed:\n\n```js\n[ 'http', 'https', 'ftp', 'mailto' ]\n```\n\nYou can override this if you want to:\n\n```js\nsanitizeHtml(\n // teeny-tiny valid transparent GIF in a data URL\n ' world',\n {\n allowedTags: [ 'img', 'p' ],\n allowedSchemes: [ 'data', 'http' ]\n }\n);\n```\n\nYou can also allow a scheme for a particular tag only:\n\n```js\nallowedSchemes: [ 'http', 'https' ],\nallowedSchemesByTag: {\n img: [ 'data' ]\n}\n```\n\nAnd you can forbid the use of protocol-relative URLs (starting with `//`) to access another site using the current protocol, which is allowed by default:\n\n```js\nallowProtocolRelative: false\n```\n\n### Discarding the entire contents of a disallowed tag\n\nNormally, with a few exceptions, if a tag is not allowed, all of the text within it is preserved, and so are any allowed tags within it.\n\nThe exceptions are:\n\n`style`, `script`, `textarea`, `option`\n\nIf you wish to replace this list, for instance to discard whatever is found\ninside a `noscript` tag, use the `nonTextTags` option:\n\n```js\nnonTextTags: [ 'style', 'script', 'textarea', 'option', 'noscript' ]\n```\n\nNote that if you use this option you are responsible for stating the entire list. This gives you the power to retain the content of `textarea`, if you want to.\n\nThe content still gets escaped properly, with the exception of the `script` and\n`style` tags. *Allowing either `script` or `style` leaves you open to XSS\nattacks. Don't do that* unless you have good reason to trust their origin.\nsanitize-html will log a warning if these tags are allowed, which can be\ndisabled with the `allowVulnerableTags: true` option.\n\n### Choose what to do with disallowed tags\n\nInstead of discarding, or keeping text only, you may enable escaping of the entire content:\n\n```js\ndisallowedTagsMode: 'escape'\n```\n\nThis will transform `
foo
bar`) or explicit (e.g. `
foo
bar
`).\n\nFor example, you may want to add spaces around a removed tag, like this:\n```js\nconst allowedTags = [ 'b' ];\nlet addSpace = false;\nconst sanitizedHtml = sanitizeHtml(\n 'There should bespaces