[caffeinewriter]

Definitely use a battle-tested HTML sanitization library if possible. There's a million different pitfalls and footguns with XSS. See: Some of the insane XSS polyglots out there that can be used for testing.

https://github.com/0xsobky/HackVault/wiki/Unleashing-an-Ulti...

[sammorrowdrums]

Also the stricter the content security policy the more xss holes you can plug.

[DarrenDev]

Thanks for the advice. It's number 1 on my list now.