HTML Sanitizer
const unsanitized_string = "abc <script>alert(1)</script> def"; // Unsanitized string of HTML
const sanitizer = new Sanitizer(); // Default sanitizer;
// Sanitize the string
let sanitizedDiv = sanitizer.sanitizeFor("div", unsanitized_string);
//We can verify the returned element type, and view sanitized HTML in string form:
console.log( (sanitizedDiv instanceof HTMLDivElement) );
// true
console.log(sanitizedDiv.innerHTML)
// "abc def"
// At some point later ...
// Get the element to update. This must be a div to match our sanitizeFor() context.
// Set its content to be the children of our sanitized element.
document.querySelector("div#target").replaceChildren(sanitizedDiv.children);
Interesting… From MDN