Introduction

In this blog, I am sharing code snippet to escape the HTML from the given string with whitelist tags and special characters.
This code snippet would help you to remove the html/script from the string excluding the whitelisted tagsand special chars so that we can avoid XSS attack.
  1. /*
  2. Function to escape the html with specified whitelist tags & spl chars
  3. @param htmlString string string to be escaped
  4. @param tags string comma separated tag list to be unescaped
  5. @param splChars string comma separated spl char list to be unescaped
  6. @example
  7. var exTags = 'b,p,strong, i';
  8. var exSplChars = '?,!';
  9. document.querySelector('#editor').innerHTML = safeHTML("<strong> Need</strong> tips? <i> Visit </i> <b> W3Schools! </b>", exTags, exSplChars);
  10. */
  11. function safeHTML(htmlString, tags, splChars) {
  12. var exDefaults = ' , %',
  13. pattern = prepareTagsRegExpPattern() + '|' + prepareCharsRegExpString();
  15. return escape(htmlString).replace(new RegExp(pattern, 'ig'), function(match) { return unescape(match); });
  17. function prepareTagsRegExpPattern() {
  18. return (tags || '').split(',').map(function(tag, index, arr) {
  19. var text = '';
  20. tag = tag.trim();
  21. if(index === 0) {
  22. text = '%3C(' + tag + '|' + '/' + tag;
  23. }else if(index === arr.length -1) {
  24. text = tag + '|' + '/' + tag + ')%3E';
  25. } else {
  26. text = tag + '|' + '/' + tag
  27. }
  28. return text;
  29. }).join('|');
  30. }
  32. function prepareCharsRegExpString() {
  33. return (splChars || '').split(',').map(function(char) { return escape(char); }).join('|') + '|' +
  34. (exDefaults || '').split(',').map(function(char) { return escape(char) }).join('|') ;
  35. }
  37. }
Here is more details