HTML Sanitizer API
Strip scripts, iframes, forms, event handlers, inline styles and javascript: links from untrusted HTML before you display it.
Send untrusted HTML in the html field (JSON or form) or as a raw text/html body and get a cleaned version back in html. The sanitizer parses the markup and removes dangerous elements entirely: script, style, iframe, object, embed, form, input, button, link, meta, base, frame and frameset.
On the remaining elements it removes every on* event handler (onclick, onerror...), every style attribute, and href, src, xlink:href or action values that start with javascript:, vbscript: or data:text. Regular formatting, links, images and tables are kept. This is the same sanitizer used by the Markdown to HTML endpoint.
The request body is limited to 1 MB and html to 2,000,000 characters. The sanitizer works on a block list, so for highly sensitive contexts combine it with a Content Security Policy.
Parameters
| Name | In | Type | Required | Default | |
|---|---|---|---|---|---|
html | body | string | yes | HTML to sanitize (max 2,000,000 characters). Can also be sent as a raw text/html body. |
Example
curl -X POST "https://apibox.io.vn/v1/html-sanitize" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"html":"<p onclick=\"alert(1)\" style=\"color:red\">Hi <a href=\"javascript:alert(1)\">click</a></p><script>alert(2)</script><img src=\"x\" onerror=\"alert(3)\">"}'const res = await fetch('https://apibox.io.vn/v1/html-sanitize', {
method: 'POST',
headers: {
Authorization: 'Bearer YOUR_API_KEY',
'Content-Type': 'application/json',
},
body: JSON.stringify({
"html": "<p onclick=\"alert(1)\" style=\"color:red\">Hi <a href=\"javascript:alert(1)\">click</a></p><script>alert(2)</script><img src=\"x\" onerror=\"alert(3)\">"
}),
});
const data = await res.json();
console.log(data);import requests
res = requests.post(
"https://apibox.io.vn/v1/html-sanitize",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"html": "<p onclick=\"alert(1)\" style=\"color:red\">Hi <a href=\"javascript:alert(1)\">click</a></p><script>alert(2)</script><img src=\"x\" onerror=\"alert(3)\">"},
timeout=30,
)
print(res.json())<?php
$ch = curl_init('https://apibox.io.vn/v1/html-sanitize');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
CURLOPT_POSTFIELDS => '{"html":"<p onclick=\\"alert(1)\\" style=\\"color:red\\">Hi <a href=\\"javascript:alert(1)\\">click</a></p><script>alert(2)</script><img src=\\"x\\" onerror=\\"alert(3)\\">"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));Response
{
"html": "<p>Hi <a>click</a></p><img src=\"x\">"
}Use cases
- Clean user-generated HTML from comments, forums or rich-text editors
- Remove tracking scripts and inline styles from imported content
- Sanitize HTML emails before showing them in a web app
- Prepare scraped HTML for safe storage and rendering
FAQ
Which tags and attributes are removed?
script, style, iframe, object, embed, form, input, button, link, meta, base, frame and frameset elements, all on* event handlers, all style attributes, and javascript:, vbscript: or data:text URLs in href, src, xlink:href and action.
Are links and images kept?
Yes. Normal <a href> and <img src> are kept; only dangerous URL schemes and event handlers such as onerror are removed.
Can I send raw HTML without JSON?
Yes. POST the HTML as the request body with Content-Type: text/html.
Related APIs
HTML to Markdown
Convert HTML or any web page URL into clean GitHub-flavored Markdown, with tables, optional article extraction and absolute links.
</>Markdown to HTML
Render GitHub-flavored Markdown to HTML with tables and strikethrough. Output is sanitized by default to strip scripts and event handlers.
TtHTML to Text
Strip tags from HTML or a web page URL and get readable plain text with line breaks preserved, plus word and character counts.