sanitize html

This block is part of the value group and was last modified in core v10.4.28.

sanitize html value v10.4.28

Sanitizes the given html

In pins 3

html required
value
The html to sanitize
allowed tags
array
Given tags will be allowed in the user input (example: div, p)
allowed attributes
array
Given attributes will be allowed in the user input (example: style, id)

Out pins 1

value
value

With allowed_tags empty, strips ALL HTML tags; script and style elements lose their CONTENT too, not just the tags. With allowed_tags set, disallowed tags are removed (their inner text kept) and allowed tags keep only safe attributes listed in allowed_attr. Executable elements, event handlers and unsafe URLs are never allowed. Styling is opt-in and whitelisted: 'style' in allowed_attr keeps inline style attributes reduced to safe layout/text/colour/background properties (no positioning out of flow, no expression(), no javascript: or non-http url()); 'style' in allowed_tags additionally inlines the document's <style> sheets into those attributes (cascade order respected) and keeps @media rules in one scrubbed <style> block : what stored e-mail needs to render as designed. 'background' in allowed_attr keeps the legacy background="https://…" of table cells.

A typical wiring for sanitize html: value feeds the html pin; the value out pin feeds convert to uppercase.

Version history

Introduced in v10.4.28.

Back to value Return to the main group to view all sub-groups Back to value Return to the group to view all blocks within this group