Browser & Web Performance · Junior · Question 64 of 75

If you must insert user-provided HTML (e.g. formatted comments), what should you do?

1Remove <script> tags with a regular expression
2Insert it with innerHTML inside a try/catch
✓Correct answer: Sanitize it with a well-tested library like DOMPurify before inserting

Explanation

Regex filters miss vectors like <img src=x onerror=...> or <svg onload>. A real sanitizer parses HTML and keeps only an allowlist.

Further reading

Test yourself

Take the Browser & Web Performance · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.