I'm using the express-validator middleware to sanitize input, but I'm having trouble with the `query.escape()` method. I followed the getting started tutorial from their site, which shows how to use it. Here's a piece of code I implemented:
```javascript
const express = require('express');
const { query, validationResult } = require('express-validator');
const app = express();
app.use(express.json());
app.get('/hello', query('person').notEmpty().escape(), (req, res) => {
const result = validationResult(req);
if (result.isEmpty()) {
return res.send(`Hello, ${req.query.person}!`);
}
res.send({ errors: result.array() });
});
app.listen(3000);
```
However, when I make a request to `http://localhost:3000/hello?person=John`, it still logs "Hello, John!" with "John" bolded, which is not the expected outcome. I've also tested with different scripts, and they execute as well. Can someone help me understand what's going wrong? Is there something incorrect in the express-validator documentation? You can look at the tutorial [here](https://express-validator.github.io/docs/guides/getting-started#sanitizing-inputs) for context.
2 Answers
It looks like you're hitting a known issue with express-validator and Express 5 where the escape function doesn't always sanitize inputs as expected. There's been discussion about this on their GitHub page. You might want to check out what they say about it [here](https://github.com/express-validator/express-validator/issues/1325) for more context. Meanwhile, using additional security measures like a dedicated XSS protection library might be a good idea for any data coming from users! Let me know if that helps or if you have more questions!
Just to add, you should also consider applying other methods of sanitization as the express-validator escape function isn't enough on its own, especially with XSS vulnerabilities in play. For example, using something like `encodeURIComponent` can offer an extra layer of security. And while client-side validation is a helpful first step, it’s vital to never trust user input completely, so always sanitize on the server side too!
Related Questions
Set Wordpress Featured Image Using Javascript
How To Fix PHP Random Being The Same
Why no WebP Support with Wordpress
Replace Wordpress Cron With Linux Cron
Customize Yoast Canonical URL Programmatically
[Centos] Delete All Files And Folders That Contain a String