# sanitized

> A recursive sanitizer for JSON inputs.

Latest version **1.3.1** (published 2026-04-20) · MIT license · 0 weekly downloads

## Install

```sh
npm install sanitized
pnpm add sanitized
yarn add sanitized
bun add sanitized
```

## Health

**Score 60/100 (C)** — status: stable.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 1.3.1 |
| Published | 2026-04-20 |
| First published | 2020-02-11 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 2 |
| Unpacked size | 14.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Nameer Rizvi |
| Maintainers | nameer |
| Keywords | typescript, utils, utilities, esm, cjs |

## Links

- npm: https://www.npmjs.com/package/sanitized
- Repository: https://github.com/nameer-rizvi/sanitized
- Homepage: https://github.com/nameer-rizvi/sanitized#readme
- Issues: https://github.com/nameer-rizvi/sanitized/issues
- npm.io page: https://npm.io/package/sanitized

## Dependencies (2)

- [he](https://npm.io/package/he.md) ^1.2.0
- [isomorphic-dompurify](https://npm.io/package/isomorphic-dompurify.md) ^3.9.0

## Alternatives

- [@openai/codex-sdk](https://npm.io/package/@openai/codex-sdk.md) — 731.4K weekly downloads
- [babel-plugin-transform-react-jsx](https://npm.io/package/babel-plugin-transform-react-jsx.md) — 565.0K weekly downloads
- [babel-helper-remove-or-void](https://npm.io/package/babel-helper-remove-or-void.md) — 508.5K weekly downloads
- [@pnpm/store-controller-types](https://npm.io/package/@pnpm/store-controller-types.md) — 186.9K weekly downloads
- [react-native-signature-canvas](https://npm.io/package/react-native-signature-canvas.md) — 155.6K weekly downloads

## Recent versions

- 1.3.1 (latest) — 2026-04-20
- 1.3.0 — 2026-04-18
- 1.2.9 — 2026-04-18
- 1.2.8 — 2026-04-18
- 1.2.7 — 2026-01-02
- 1.2.6 — 2024-10-03
- 1.2.5 — 2024-07-08
- 1.2.4 — 2024-05-26
- 1.2.3 — 2024-05-24
- 1.2.2 — 2024-05-24
- 1.2.1 — 2024-03-25
- 1.2.0 — 2023-12-18
- 1.1.9 — 2023-05-24
- 1.1.8 — 2023-01-10
- 1.1.7 — 2022-05-02
- … 17 more at https://npm.io/package/sanitized/versions

## README

# sanitized

A recursive sanitizer for JSON inputs. Traverses nested arrays and objects, sanitizing every string value against XSS attacks using [DOMPurify](https://github.com/cure53/DOMPurify) and decoding HTML entities with [he](https://github.com/mathiasbynens/he). Ideal for sanitizing form data before submission to the back-end.

## Installation

```bash
npm install sanitized
# or
yarn add sanitized
```

### Node v16 Support

```bash
npm install sanitized@1.2.1
# or
yarn add sanitized@1.2.1
```

## Usage

```javascript
const sanitized = require("sanitized").default; // commonjs
// or
import sanitized from "sanitized"; // esm
```

### Strings

```javascript
sanitized("<img src=x onerror=alert(1)//>");
// '<img src="x">'
```

### Arrays

```javascript
sanitized(["<svg><g/onload=alert(2)//<p>"]);
// ['<svg><g></g></svg>']
```

### Objects

```javascript
sanitized({
  test: '<math><mi//xlink:href="data:x,<script>alert(4)</script>">',
});
// { test: '<math><mi></mi></math>' }
```

### Nested

```javascript
sanitized([
  "<svg><g/onload=alert(2)//<p>",
  {
    name1: [
      '<math><mi//xlink:href="data:x,<script>alert(4)</script>">',
      { name2: "<p>abc<iframe//src=jAva&Tab;script:alert(3)>def" },
    ],
  },
]);
// [
//   "<svg><g></g></svg>",
//   { name1: ["<math><mi></mi></math>", { name2: "<p>abc</p>" }] }
// ]
```

### Non-string primitives

Non-string values (`number`, `boolean`, `null`, `undefined`) are returned as-is.

```javascript
sanitized(42); // 42
sanitized(null); // null
sanitized(undefined); // undefined
```

### DOMPurify options

The second parameter accepts any [DOMPurify config options](https://github.com/cure53/DOMPurify#can-i-configure-dompurify).

```javascript
sanitized("<b>hello</b>", { ALLOWED_TAGS: ["b"] }); // "<b>hello</b>"
```

## License

MIT

---
_Source: https://npm.io/package/sanitized · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._