)|(\<[/]a\>)|("})|(\)/gmi,‘’);
Second option: create a html doc using DOMParser() in memory and remove not required tags(script, style, head, body, title, and iframe) and any attribute that starts with on\*\*\*() and finally append html to main document
Please suggest an option which will not fail review for not sanitizing, any help in this matter is appreciated.
---
**Author:**  [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [November 27, 2016, 6:17am UTC](https://discourse.mozilla.org/t/sanitize-html-string-from-ajax-call-in-content-script/12220/2 "2016-11-27T06:17:22Z")
The problem with **any** kind of string to DOM conversion is that the DOM is executed.
Even if addon doesn’t insert it in the page, the browser still executes it so if there are scripts they will be executed.
You can check my answer here:
[https://discourse.mozilla-community.org/t/download-a-json-from-personnal-website/12158/2](https://discourse.mozilla-community.org/t/download-a-json-from-personnal-website/12158/2)
You can load a page, as it is, in a panel (eg with iframe) and manipulate the result.
loading a JSON response has risks since it is unknown.
---
**Author:**  [@surisriram](https://discourse.mozilla.org/u/surisriram)\
**Post date:** [November 28, 2016, 10:33pm UTC](https://discourse.mozilla.org/t/sanitize-html-string-from-ajax-call-in-content-script/12220/3 "2016-11-28T22:33:15Z")
erosman,
Appreciate your response, can you please explain in detail or provide some examples when you say “You can load a page, as it is, in a panel (eg with iframe) and manipulate the result.” Are you talking about iframe sandboxing
on another thought can i use this api
Caja --\>[https://developers.google.com/caja/](https://developers.google.com/caja/)
do you know if anybody is using it ?
Appreciate your help
---
**Author:**  [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [November 29, 2016, 6:01am UTC](https://discourse.mozilla.org/t/sanitize-html-string-from-ajax-call-in-content-script/12220/4 "2016-11-29T06:01:53Z")
AFA panel… look at the examples on panel
I dont know about Caja.
Adding another library means more complex review process (which takes longer).
The claims of “safe” could be safe for a web-page but not for an addon.