A TypeScript implementation of PHP's strip_tags for safely removing HTML tags from strings.
striptags is a TypeScript library that implements PHP's strip_tags function, enabling safe removal of HTML tags from strings. It solves the problem of sanitizing user-generated HTML content to prevent cross-site scripting (XSS) attacks while offering flexibility in tag filtering. The library provides both a simple function for one-off use and a state machine for processing streaming text.
Developers working with TypeScript or JavaScript who need to sanitize HTML input in web applications, especially those handling user-generated content or migrating PHP functionality.
Developers choose striptags for its zero-dependency design, built-in XSS protection by default, and faithful replication of PHP's strip_tags behavior in a TypeScript environment. Its streaming support and configurable tag filtering offer practical advantages over basic string replacement methods.
An implementation of PHP's strip_tags in Typescript.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The library has no external dependencies, making it lightweight and easy to integrate without bloating the project, as emphasized in the README.
Output is guaranteed XSS-safe when used as text within HTML tags by default, prioritizing security without additional configuration, as stated in the safety section.
Includes a StateMachine class for safely processing text streams across multiple calls, useful for handling large or chunked data, demonstrated in the advanced usage examples.
Allows specifying allowed or disallowed tags via Set objects, providing fine-grained control over which tags are stripped or kept, as shown in the basic usage examples.
Version 4 is currently in alpha, meaning it may have bugs, breaking changes, and is not recommended for production use without careful testing, as noted in the README.
When using allowedTags or disallowedTags options, the XSS safety guarantee is removed, as malicious attributes in allowed tags can still pose risks, explicitly warned in the safety section.
The library only strips HTML tags and does not sanitize attributes, so it's insufficient for full HTML sanitization against all XSS vectors, limiting its use in security-critical applications.