Java, JavaScript: Avoid escaping particular HTML tags

Question

I am using org.apache.commons.lang.StringEscapeUtils to escape HTML tags:

StringEscapeUtils.escapeHtml(str);

What I want is to avoid escaping few particular tags. e.g.

<h1>this is h1</h1>
<ul>
<li></li>
<li></li>
</ul>

After escaping it should connvert all < to < and > to > except <ul> and <li> tag. Here i don't want to escape <ul> <li> tags because in HTML page i have to show content as list so i need ul and li.

How can i do this in java and javascript.

Dave Newton · Accepted Answer · 2014-06-01 03:01:32Z

1

You don't want a simple string escape util, which is what you're using.

What you want is an HTML sanitizer, like the OWASP Java HTML Sanitizer. It allows whitelists of HTML tags to not escape, e.g., custom HTML policies with which you can specify allowed tags, in case the default sanitizers don't meet your needs.

Other libraries also do this, like JSoup with its cleaning functionality.

answered Jun 1, 2014 at 3:01

Dave Newton

161k27 gold badges263 silver badges310 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Manish Kumar Over a year ago

which one is preferable

Dave Newton Over a year ago

@Manish Preference questions are OT for SO. Whichever suits your needs best.

Manish Kumar Over a year ago

its good but the problem is its removes tag e.g <h1> completly. that i dont want what i want is just encode it

Collectives™ on Stack Overflow

Java, JavaScript: Avoid escaping particular HTML tags

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related