Sanitization is the process of taking [HTML](/courses/html) that may contain unsafe markup and producing a version that only contains content allowed by your security rules. This is necessary when the application intentionally allows users to create formatted [HTML](/courses/html), such as: ```text Articles Comments with formatting Rich text editor content Documentation User profiles with rich descriptions ``` ### Why React Escaping Is Not Enough for Raw HTML Normal [JSX](/courses/reactjs) is safe for displaying text: ```jsx

{article.content}

``` But this displays HTML tags as text rather than formatting them. If an application needs formatting such as: ```html

React Hooks

Hooks let you reuse logic.

...

``` it may need to render HTML intentionally. Once raw HTML is rendered, sanitization becomes important. ### Use a Well-Maintained HTML Sanitizer Do not try to build HTML sanitization with simple regular expressions such as: ```javascript html.replace(/.*?<\/script>/g, ""); ``` HTML parsing is complex, and dangerous behavior is not limited to `