v146 · Security · XSS Sanitizer Demo

XSS Sanitizer Demo

Type or paste HTML containing potentially dangerous markup. The default Sanitizer strips scripts, inline event handlers, and javascript: URLs before injecting into the DOM. The serialized output shows exactly what survived sanitization.

Chrome 146 required for the native Sanitizer API. In older browsers this demo falls back to a JavaScript innerHTML-based approach with a simplistic pattern-filter to illustrate the concept — it is NOT a real sanitizer.

live demo

Input HTML (untrusted):

Rendered output (after sanitization):

Serialized sanitized HTML:

—

What was stripped / kept:

—

what the default sanitizer blocks

<script> elements and their content
Inline event handler attributes: onclick, onerror, onload, onmouseover, etc.
href="javascript:…" and other javascript: URLs
<iframe>, <object>, <embed>, <form>, <base>
SVG / MathML elements that can execute scripts

code

// Default sanitizer — safe for most use cases
const output = document.getElementById('output');
output.setHTML(userInput);

// Check what's available after sanitization
console.log(output.innerHTML);
// Scripts, event handlers, javascript: URLs → gone
// <b>, <p>, <a href="https://…"> → preserved

// Compare: the unsafe alternative (DON'T DO THIS with untrusted input)
output.innerHTML = userInput; // XSS risk!

live demo

what the default sanitizer blocks

code

see also