One thing on this page is worth reading: stripping tags is not sanitising. It turns markup into plain text; it does not turn text into markup that is safe to insert into a page. Those are different jobs, and the second needs a real sanitiser on the server.
Block elements become line breaks. Without that, every paragraph runs together into one continuous line — the commonest complaint about tools that do this.
The contents of script and style go too, not just their tags. Removing only the tags leaves CSS and JavaScript sitting in the middle of your text.
And entities are decoded last. Decoding first would turn <script> into a live tag — creating markup out of text that was deliberately escaped.
No, and this is the one thing worth reading on this page. Stripping tags turns markup into plain text; it does not produce markup that is safe to insert into a page. Those are different jobs and the second one needs a real sanitiser running on the server that owns the output. If you are removing HTML for security reasons, this is the wrong tool.
Because block elements become line breaks. Removing tags without them runs every paragraph, list item and table row together into one continuous line, which is the commonest complaint about tools that do this. Inline elements like span and em do not break.
They go entirely, not just their tags. Removing only the tags would leave a page of CSS rules and JavaScript sitting in the middle of your text, which is never what “remove the HTML” means. An unclosed script element takes the rest of the input, which is what a browser does too.
Stripping removes markup so the text reads as text. Escaping converts the markup characters into entities so the text DISPLAYS as markup — useful when you want to show someone a code sample. They are opposite operations and this page does both.
Because every other replacement introduces one. Escape the less-than sign first and you get <, then escaping ampersands turns that into &lt; — the classic double-escape. The ampersand has to go first or the output is wrong in a way that looks almost right.
Because decoding first would turn <script> into a live tag — creating markup out of text that was deliberately escaped, which is the exact opposite of the job. Decoding happens last, on what is left.
Repeated until nothing more is found. <scr<script>ipt> leaves a live tag behind when the pattern runs only once.
When escaping, the ampersand is replaced first. Do < first and the < it produces becomes &lt; — the classic double-escape.
Runs entirely in your browser. Stripping tags is not sanitising — this produces plain text from markup, not markup that is safe to insert into a page. For security, use a real sanitiser on the server that owns the output. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
