Question

What is the best way to sanitize message content on the server side which is received from client as one of the query string parameters? This message is also meant to be resend to other connected clients so it have be secure in terms of code execution or injection (JavaScript or HTML) on server or client side.

Answer 1

To protect node.js against XSS I borrowed this from snippet jade:

/**
 * Escape the given string of `html`.
 *
 * @param {String} html
 * @return {String}
 * @api private
 */

function sanitize(html){
    return String(html)
        .replace(/&(?!\w+;)/g, '&')
        .replace(/</g, '&lt;')
        .replace(/>/g, '&gt;')
        .replace(/"/g, '&quot;');
}

P.S: You should always do proper server-side filtering