\
**Category:** Development\
**Created:** [September 21, 2017, 7:14am UTC](https://discourse.mozilla.org/t/sanitize-html/19387 "2017-09-21T07:14:33Z")\
**Posts on this page:** 3\
**Page:** 1
**Author:**  [@dishita](https://discourse.mozilla.org/u/dishita)\
**Post date:** [September 21, 2017, 7:14am UTC](https://discourse.mozilla.org/t/sanitize-html/19387/1 "2017-09-21T07:14:33Z")
Got this warning from AMO:
> This add-on is creating DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means.
Will something like this ([javascript - Sanitize/Rewrite HTML on the Client Side - Stack Overflow](https://stackoverflow.com/a/10772475/6113286)) work:
```
String.prototype.sanitizeHTML=function (white,black) {
if (!white) white="b|i|p|br";//allowed tags
if (!black) black="script|object|embed";//complete remove tags
var e=new RegExp("(<("+black+")[^>]*>.*|(?!<[/]?("+white+")(\\s[^<]*>|[/]>|>))<[^<>]*>|(?!<[^<>\\s]+)\\s[^]+(?=[/>]))", "gi");
return this.replace(e,"");
```
}
---
**Author:**  [@dishita](https://discourse.mozilla.org/u/dishita)\
**Post date:** [September 21, 2017, 8:39am UTC](https://discourse.mozilla.org/t/sanitize-html/19387/2 "2017-09-21T08:39:21Z")
Now using `document.createElement('div');` to generate the DOM, I guess this approach is ok?
---
**Author:**  [@NilkasG](https://discourse.mozilla.org/u/NilkasG)\
**Post date:** [September 21, 2017, 2:14pm UTC](https://discourse.mozilla.org/t/sanitize-html/19387/3 "2017-09-21T14:14:00Z")
`document.createElement('div')` is defensively fine (unless, of course you set the `innerHTML` of the new div).
If you do want to use a sanatization function, please don’t just grab a poorly documented function somewhere from the internet. It’s a bit hard to tell because not eve the arguments are documented, but I don’t think the function above works as intended.