Sanitization API
API that provides methods to help you avoid code injection in HTML, JavaScript and SQL snippets that need to include untrusted content, i.e. content gathered from end users.
Summary
| Action | Description |
|---|---|
| BuildSafe_InClauseIntegerList | Returns a comma-delimited text value containing all the integer values provided as input. The returned value can be safely used in a SQL "IN" clause. |
| BuildSafe_InClauseTextList | Returns a comma-delimited text value with the encoded version of all the text values provided as input. The returned value can be safely used in a SQL "IN" clause. |
| SanitizeHtml | Sanitizes the provided HTML using the HtmlSanitizer NuGet package. |
| VerifyJavascriptLiteral | Ensures the provided JavaScript only contains JavaScript/JSON literals such as string, array, or Object literals. If it contains anything else, an INVALID JAVASCRIPT LITERAL exception is thrown. Learn more about JavaScript literals in the MDN documentation. |
| VerifySqlLiteral | Deprecated. Ensure the provided SQL only contains literals. If it contains anything else, an INVALID SQL LITERAL exception is thrown. |
Actions
BuildSafe_InClauseIntegerList
Returns a comma-delimited text value containing all the integer values provided as input. The returned value can be safely used in a SQL "IN" clause.
Inputs
- ValueList
- Type: RecordList of IntegerLiteral. Mandatory.
List of integer values to include in the returned value.
Outputs
- Output
- Type: Text.
A string containing comma-separated integer values to be used in a SQL "IN" clause.
BuildSafe_InClauseTextList
Returns a comma-delimited text value with the encoded version of all the text values provided as input. The returned value can be safely used in a SQL "IN" clause.
Inputs
- ValueList
- Type: RecordList of TextLiteral. Mandatory.
List of text values to include in the returned value.
Outputs
- Output
- Type: Text.
A string containing a set of encoded text values separated by commas to be used in a SQL "IN" clause.
SanitizeHtml
Sanitizes the provided HTML using the HtmlSanitizer NuGet package.
Note: The underlying library was recently changed from OWASP Java HTML Sanitizer Project. Check the Release Notes for a summary of what changed.
Inputs
- Html
- Type: Text. Mandatory.
The HTML to sanitize.
Outputs
- SanitizedHtml
- Type: Text.
The sanitized HTML.
VerifyJavascriptLiteral
Ensures the provided JavaScript only contains JavaScript/JSON literals such as string, array, or Object literals. If it contains anything else, an INVALID JAVASCRIPT LITERAL exception is thrown. Learn more about JavaScript literals in the MDN documentation.
Inputs
- JavascriptLiteral
- Type: Text. Mandatory.
The JavaScript literal to sanitize.
Outputs
- SanitizedJavascriptLiteral
- Type: Text.
The sanitized JavaScript literal.
VerifySqlLiteral
Deprecated. Ensures the provided SQL only contains literals. If it contains anything else, an INVALID SQL LITERAL exception is thrown.
Inputs
- SqlLiteral
- Type: Text. Mandatory.
The SQL to sanitize.
Outputs
- SanitizedSqlLiteral
- Type: Text.
The sanitized SQL.
Structures
IntegerLiteral
Simple structure holding a long integer value. Used as a record definition when providing a list of IntegerLiteral records to include in a SQL "IN" clause.
Attributes
- Value
- Type: LongInteger. Mandatory.
An integer value to consider when creating a SQL "IN" clause.
TextLiteral
Simple structure holding a text value. Used as a record definition when providing a list of TextLiteral records to include in a SQL "IN" clause.
Attributes
- Value
- Type: Text (2000). Mandatory.
A text value to consider when creating a SQL "IN" clause.