Member Avatar for valonesal

Does anyone know the safe tags to use on a website or know where I may be able to find a list of them?

Thank you.

  • 4 Contributors
  • 3 Replies
  • 131 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by Gaetane

Dani AI

Generated

asked for a list of "safe" HTML tags. , and pointed to documentation and blog lists, which are useful starting points. The practical question is less "which tags exist" and more "which tags and attributes can you safely allow and how do you enforce that."

Core rules: use a whitelist, not a blacklist; strip dangerous attributes (event handlers like onclick) and dangerous elements (script, iframe, object, embed, form); and validate URL schemes in href/src so javascript: and risky data: URIs are rejected. A minimal example allowlist is: p, br, b, strong, i, em, u (optional), ul, ol, li, blockquote, pre, code, a[href], img[src,alt] — and only allow href/src to be http(s) or mailto. Avoid letting users supply style unless you parse and sanitize CSS strictly.

Do not roll your own sanitizer. Use a tested library and sanitize on the server as the authoritative step. For browser-side sanitizing consider DOMPurify. For server-side options see libraries such as jsoup or OWASP’s Java HTML Sanitizer. Follow the OWASP XSS Prevention Cheat Sheet for canonicalization, protocol checks, and normalization. Add a Content Security Policy as defense-in-depth (CSP docs).

Workflow: decide the allowed subset, enforce attribute and protocol rules, sanitize with a library, run unit tests and known XSS payloads, and review outputs manually. Watch out for target="_blank" (use rel="noopener"), data: URIs, and user-supplied CSS. For a definitive element reference, consult the HTML element index such as on MDN (HTML elements).

Recommended Answers

All 3 Replies

Member Avatar for Member #120589

Look at the w3 website. w3schools is not the same, and has some mistakes - although not too bad and provides the info in an accessible (with a small 'a') manner.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.