Question

I have a textarea that users can input HTML. When they hit preview I place the textarea in a div and let them preview it.

I’m looking for an easy way to:

1. Disable all malicious code.
2. Validate the text area is not going to cause issues when showing in the div. For example if there is an input like:

---

<script type="text/javascript">
    alert('hi there'); '
 </script>

The ‘ is not a typo… if I let that happen I get into a bad state. But I think if i disable all scripts I should be good to go.

Answer 1

I would recommend PageDown to handle escaping on the client side. You’ll want to glance at the documentation, in particular the Sanitizer section that will remove malicious HTML/Javascript.