toStaticHTML method

Removes dynamic HTML elements and attributes from an HTML fragment.

Internet Explorer 8

 

Syntax

var pbstrStaticHTML = window.toStaticHTML(bstrHTML);

Parameters

bstrHTML [in]

Type: String

An HTML fragment.

pbstrStaticHTML [out, retval]

Type: String

An HTML fragment consisting of static elements only.

Return value

Type: String

An HTML fragment consisting of static elements only.

Standards information

There are no standards that apply here.

Remarks

The toStaticHTML method can be used to remove event attributes and script from user input before it is displayed as HTML. Malicious HTML can be passed on a URL, in form parameters, or across domains by XDomainRequest or postMessage. Always validate user input before adding it as an HTML fragment to a webpage or storing it in a database.

Note   This method does not filter the attributes of the base element. This can cause potentially unwanted redirect requests for link and anchor elements injected into a webpage. For best results, only use toStaticHTML to modify elements in the body of a webpage.
 

For more info about toStaticHTML, see Making HTML safer: details for toStaticHTML.

Examples

The following script demonstrates how toStaticHTML sanitizes script and dynamic HTML attributes. The result of the operation is: <span>Click Me</span>.

JavaScript
Copy 

<script type="text/javascript">
function sanitize() 
{
    var szInput = myDiv.innerHTML;
    var szStaticHTML = toStaticHTML(szInput);
    ResultComment = "\ntoStaticHTML sanitized the HTML fragment as follows:\n"
        + "Original Content:\n" + szInput + "\n"
        + "Static Content:\n" + szStaticHTML + "\n";
    myDiv.innerText = ResultComment;
}
</script>
</head>
<body onload="sanitize()">
    <div id="myDiv">
    <script type="text/javascript">function test() { alert("Testing, Testing, 123..."); }</script>
    <span onclick="test()">Click Me</span>
    </div>
</body>

See also

window
Making HTML safer: details for toStaticHTML
innerHTML

 

 

Show: