HTML Sanitizer
const unsanitized_string = "abc <script>alert(1)</script> def"; // Unsanitized string of HTML
const sanitizer = new Sanitizer(); // Default sanitizer;
// Sanitize the stringlet sanitizedDiv = sanitizer.sanitizeFor("div", unsanitized_string);
//We can verify the returned element type, and view sanitized HTML in string form:console.log( (sanitizedDiv instanceof HTMLDivElement) );
// trueconsole.log(sanitizedDiv.innerHTML)
// "abc def"// At some point later ...// Get the element to update. This must be a div to match our sanitizeFor() context.// Set its content to be the children of our sanitized element.document.querySelector("div#target").replaceChildren(sanitizedDiv.children);
Interesting… From MDN