HTML Sanitizer
Strip scripts, iframes, forms, event handlers, inline styles and javascript: links from untrusted HTML before you display it.
Result
Press “Run” to see the result.
Send untrusted HTML in the html field (JSON or form) or as a raw text/html body and get a cleaned version back in html. The sanitizer parses the markup and removes dangerous elements entirely: script, style, iframe, object, embed, form, input, button, link, meta, base, frame and frameset.
On the remaining elements it removes every on* event handler (onclick, onerror...), every style attribute, and href, src, xlink:href or action values that start with javascript:, vbscript: or data:text. Regular formatting, links, images and tables are kept. This is the same sanitizer used by the Markdown to HTML endpoint.
The request body is limited to 1 MB and html to 2,000,000 characters. The sanitizer works on a block list, so for highly sensitive contexts combine it with a Content Security Policy.
Use this in your code
curl -X POST "https://apibox.io.vn/v1/html-sanitize" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"html":"<p onclick=\"alert(1)\" style=\"color:red\">Hi <a href=\"javascript:alert(1)\">click</a></p><script>alert(2)</script><img src=\"x\" onerror=\"alert(3)\">"}'const res = await fetch('https://apibox.io.vn/v1/html-sanitize', {
method: 'POST',
headers: {
Authorization: 'Bearer YOUR_API_KEY',
'Content-Type': 'application/json',
},
body: JSON.stringify({
"html": "<p onclick=\"alert(1)\" style=\"color:red\">Hi <a href=\"javascript:alert(1)\">click</a></p><script>alert(2)</script><img src=\"x\" onerror=\"alert(3)\">"
}),
});
const data = await res.json();
console.log(data);import requests
res = requests.post(
"https://apibox.io.vn/v1/html-sanitize",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"html": "<p onclick=\"alert(1)\" style=\"color:red\">Hi <a href=\"javascript:alert(1)\">click</a></p><script>alert(2)</script><img src=\"x\" onerror=\"alert(3)\">"},
timeout=30,
)
print(res.json())<?php
$ch = curl_init('https://apibox.io.vn/v1/html-sanitize');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
CURLOPT_POSTFIELDS => '{"html":"<p onclick=\\"alert(1)\\" style=\\"color:red\\">Hi <a href=\\"javascript:alert(1)\\">click</a></p><script>alert(2)</script><img src=\\"x\\" onerror=\\"alert(3)\\">"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));API documentation → Get a free API key
FAQ
Which tags and attributes are removed?
script, style, iframe, object, embed, form, input, button, link, meta, base, frame and frameset elements, all on* event handlers, all style attributes, and javascript:, vbscript: or data:text URLs in href, src, xlink:href and action.
Are links and images kept?
Yes. Normal <a href> and <img src> are kept; only dangerous URL schemes and event handlers such as onerror are removed.
Can I send raw HTML without JSON?
Yes. POST the HTML as the request body with Content-Type: text/html.