Question

Is there a javascript function that recognize if a string variable contains HTML code?
I would like to avoid this case because if I use innerHTML and the user has submitted something like <img src='link'> it doesn’t appear the string but the real image…
I hope I explained
Thank you!

Answer 1

You can just replace 3 very special characters:
&: used for glyph notation
<: opening bracket for html tags
>: closeing bracket for html tags

function make_safe(input) {
    return input.replace("&", "&amp;").replace(/(<?)([^<>]*)(>?)/g, function (a,b,c,d) {
        if ((b+c+d).toLowerCase() === "<br>") return "<br>";

        if (b === "<") b = "&lt;";
        if (b === ">") b = "&gt;";

        if (d === "<") d = "&lt;";
        if (d === ">") d = "&gt;";

        return b+c+d;
    }).replace(/\r?\n/g,"<br>");
}

// example:
mydiv.innerHTML = make_safe('<img src="/pic.jpg">');

I did a little magic so \r\n becomes a newline, and <br> tags are preserved