Takes a string containing HTML and strips all dangerous content: <script> tags, onclick attributes, JavaScript: URLs, CSSexpression() attacks, data URIs, and iframe injections. Preserves safe formatting tags (<p>, <b>, <i>, <a> with a validated href) if the user wants them, or strips everything to plain text
-
Updated
May 7, 2026 - Python