# sanitizeHtml

**Kind:** Function

**Source:** [`atloria-monorepo/apps/web/src/lib/sanitizeHtml.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/apps/web/src/lib/sanitizeHtml.ts#L16)

Sanitize an HTML string before it is placed into the DOM via
dangerouslySetInnerHTML. Strips <script>, event-handler attributes (onerror,
onload, …), javascript: URLs and other active-content vectors while keeping
ordinary formatting markup.

DOMPurify needs a DOM (window). The call sites that use this — the support
agent chat console and the variant preview — render their content only after
a client-side fetch, so there is nothing to sanitize during SSR; on the
server (no window) we return '' and the browser fills in the sanitized markup
on hydration. Use this at every innerHTML sink that renders content we did
not author in code (AI output, stored doc content, marked() output, …).

## Signature

```ts
function sanitizeHtml(dirty: string | null | undefined): string
```

## Parameters

| Name | Type |
|---|---|
| `dirty` | `string | null | undefined` |

**Returns:** `string`