Sanitize innerHTML in javascript

Question

I am using that block of code and bring told by a code validator that this should be sanitized.

What is wrong with it and how can i sanitize it?

el1 = document.getElementById('quote'); //this is fine el1.innerHTML = quoteNew; //this should be sanitized

If it is supposed to be just text, then the safe way is el1.textContent = quoteNew; — Gabriele Petrioli
– Gabriele Petrioli, Commented May 16, 2017 at 23:27
@GabyakaG.Petrioli : It works!. Please make an answer so that I can choose your answer as best answer. — scandalous
– scandalous, Commented May 17, 2017 at 6:21

Gabriele Petrioli · Accepted Answer · 2017-05-17 07:17:02Z

5

If the contents of quoteNew are just text to display, then use the textContent property of the element.

 el1.textContent = quoteNew;

answered May 17, 2017 at 7:17

Gabriele Petrioli

197k35 gold badges275 silver badges331 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Jason 'Slingshot' Miller Over a year ago

What if I need to display HTML?

Gabriele Petrioli Over a year ago

@S.W.G. then you need to sanitize it according to your requirements. That is if you do not know where the contents of quoteNew are coming and if they are safe to render.

Jason 'Slingshot' Miller Over a year ago

In my case contant comes from HTTPS request to my server, the only case it could be injected malicious content is if the user connects using bad WiFi so to exclude MITM attack I found a library to sanitize it, just to be extra safe.

Collectives™ on Stack Overflow

Sanitize innerHTML in javascript

1 Answer 1

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Related