Express middleware for the sanitizer module using Caja's HTML Sanitizer and HTML escape using htmlencode. Forked from express-sanitize-escape as the original package is no longer maintained
Last updated a year ago by kimorin .
MIT · Repository · Bugs · Original npm · Tarball · package.json
$ cnpm install express-sanitized-escaped 
SYNC missed versions from official npm registry.


Build Status


npm install express-sanitize-escape


Place this directly after all express.use(bodyParser) middlewares and before any express middleware that accesses query or body parameters, e.g.:

var bodyParser = require('body-parser');
var express = require('express');
var expressSanitized = require('express-sanitize-escape');

app.use(expressSanitized.middleware()); // this line follows app.use(bodyParser.json) or the last body parser middleware

The above sanitizes req.body and req.query. In order to sanitize req.params as well, pass in an express router or app to expressSanitized.sanitizeParams, along with the names of the params to sanitize, e.g.:

var express = require('express');
var expressSanitized = require('express-sanitize-escape');

var router = express.router();
expressSanitized.sanitizeParams(router, ['id','name']);

router.get('/:id', function(req, res, next)
    // is now sanitized.

router.get('/:name', function(req, res, next)
    // is now sanitized.


The string

'<script>document.write('cookie monster')</script> download now'

will be sanitized to ' download now'.


< > ' " &

will be escaped to &lt; &gt; &#39; &quot; &amp;


This is a basic implementation of Caja-HTML-Sanitizer with the specific purpose of mitigating against persistent XSS risks. And node-htmlencode to escape all html entities


This module trusts the dependencies to provide basic persistent XSS risk mitigation. A user of this package should review all packages and make their own decision on security and fitness for purpose.

This module was inspired by express-sanitizer and express-sanitized. The difference here is: This middleware automatically sanitizes post and query values parameter. And automatically html escapes all strings.



  • This is a breaking change.
  • Change to use exports instead of module exports
  • Middleware is now exports.middleware so app.use(expressSanitized()) is now app.use(expressSanitized.middleware())
  • Added a function to decode the body expressSanitized.htmlDecodeBody()
  • Added tests for unicode characters


  • Added function to sanitize request params of a router


  • Added additional test for nested object and an array
  • Added chai js for testing


  • Added htmlencoding
  • Change filer to recurse through all values of the object and sanitize only values that are strings
  • Updated docs to express 4.x and new bodyParser middleware
  • Added License file


  • Initial release



Copyright (c) 2016 Finger Food Studios, MIT License

Current Tags

  • 1.1.1                                ...           latest (a year ago)

1 Versions

  • 1.1.1                                ...           a year ago
Maintainers (1)
Today 0
This Week 2
This Month 5
Last Day 0
Last Week 5
Last Month 2
Dependencies (3)
Dev Dependencies (6)
Dependents (0)

Copyright 2014 - 2016 © |