the safest way is to rely on the browser text field to properly avoid the content. Here is an example:
function stripHTML(dirtyString) { var container = document.createElement('div'); var text = document.createTextNode(dirtyString); container.appendChild(text); return container.innerHTML;
Remember that the browser accesses special TextNodes characters when we access the html lines ( innerHTML , outerHTML ). For comparison, accessing text values ββ( innerText , textContent ) will result in raw strings, which means they are unsafe and may contain XSS.
If you use jQuery , then using .text() safe and backward compatible. See Other answers to this question.
The easiest way in pure JavaScript if you work with browsers. <= Internet Explorer 8:
string.replace(/(<([^>]+)>)/ig,"");
But there is a problem with parsing HTML with regular expression, so this will not provide very good security. Also, this only applies to HTML characters, so it is not completely safe for xss.
Simon Boudrias Oct 30 '12 at 13:30 2012-10-30 13:30
source share