1011008: Added New UG content for Input sanitization by ponselvajeganathan · Pull Request #7846 · syncfusion-content/blazor-docs

ponselvajeganathan · 2026-03-06T11:20:05Z

Description

Added New UG content for Input sanitization

Code Studio usage(Mandatory)

Code Studio used in this PR/MR?
- Yes
- No
If Yes: Primary use (choose one)
- Generate new content
- Refactor/improve existing content
- Review assistance (explanations/summaries)
- Other:
Outcome
- Saved time
- Neutral
- Cost time
If “Cost time” explain in short (1 or 2 lines):

Type of Change

New documentation page
Update to existing documentation
Bug fix (broken links, typos, formatting issues)
Structural change (folders, navigation, index)
Content improvement (clarity, examples, screenshots)
Other (please describe):

Reviewer Checklist (Mandatory)

Reviewed the provided Code Studio usages related information
Content changes follow UG/Documentation guidelines
All provided information reviewed and verified
Links and previews checked

SyncfusionBuild · 2026-03-06T11:21:01Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-06T11:23:31Z

CI Status: FAILURE ❌
Source Compilation: SUCCESS ✅
Failure Reason: CI Failure with violation
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 8
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

SyncfusionBuild · 2026-03-06T11:50:47Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-06T11:54:07Z

CI Status: SUCCESS ✅
Source Compilation: SUCCESS ✅
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

blazor/common/security/input-sanitization.md

kmkrish001 · 2026-03-06T12:38:16Z

blazor/common/security/input-sanitization.md

+First, install the package:
+
+```
+dotnet add package HtmlSanitizer


suggest Microsoft package, do not suggest third parties.

kmkrish001 · 2026-03-06T12:40:27Z

blazor/common/security/input-sanitization.md

+
+## TextBox / TextArea
+
+Syncfusion **TextBox** and **TextArea** components bind plain text. Sanitize the value only if you render it as HTML.


modify content like, syncfusion components support sanitization

kmkrish001 · 2026-03-06T12:41:19Z

blazor/common/security/input-sanitization.md

+{% endhighlight %}
+{% endtabs %}
+
+## Validation vs. Sanitization


is this validation topic required

kmkrish001

Address this comments.

SyncfusionBuild · 2026-03-10T07:42:00Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-10T07:42:29Z

The running CI Job is terminated due to changes committed on the source branch for this Merge Request and CI triggered for latest commit.

SyncfusionBuild · 2026-03-10T07:42:50Z

CI Status: ABORTED ❌
Source Compilation: FAILURE ❌
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-10T07:43:21Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-10T07:45:01Z

CI Status: SUCCESS ✅
Source Compilation: SUCCESS ✅
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

kmkrish001 · 2026-03-10T11:04:51Z

blazor/common/security/input-sanitization.md

+
+# Input Sanitization with Syncfusion Blazor Components
+
+Input sanitization ensures that any user-provided content whether typed, pasted, uploaded, or received from external sources is safe to process or display in a Syncfusion Blazor application. Because user input can contain unsafe HTML or script content, sanitization prevents malicious code execution and ensures application integrity.


In the introduction mention which syncfusion API using for sanitization, what are the components below covered.

kmkrish001 · 2026-03-10T11:09:44Z

blazor/common/security/input-sanitization.md

+
+## Built-In Sanitization Features
+
+Several Syncfusion Blazor components include HTML sanitization capabilities to prevent harmful script or markup from being processed. Components that accept or render HTML content such as the Rich Text Editor have built-in mechanisms to remove unsafe elements before rendering.


Not mentioning the built-in option API name

kmkrish001 · 2026-03-10T11:11:47Z

blazor/common/security/input-sanitization.md

+When enabled, automatically removes unsafe tags and attributes such as `<script>` tags, event attributes (such as onload, onclick), and other unsafe content before rendering it. This ensures only clean and safe HTML is allowed in the editor.
+
+## How to Sanitize Input in Blazor
+


explain this shortly with sample code.

kmkrish001 · 2026-03-10T11:12:51Z

blazor/common/security/input-sanitization.md

+The encoded value ensures the Grid displays safe text without interpreting any malicious input.
+
+## See Also
+


add csp topic in see also

kmkrish001 · 2026-03-10T11:16:50Z

blazor/common/security/input-sanitization.md

+Sanitized output: x
+```
+
+## Types of Attacks Prevented


title not proper

kmkrish001 · 2026-03-10T11:17:55Z

blazor/common/security/input-sanitization.md

+
+{% endhighlight %}
+{% endtabs %}
+


attach playground sample link for this.

kmkrish001 · 2026-03-10T11:19:08Z

blazor/common/security/input-sanitization.md

+{% highlight razor %}
+
+@page "/sanitize-example"
+


components namespace not used, which packages...

kmkrish001 · 2026-03-10T11:20:58Z

blazor/common/security/input-sanitization.md

+### Rich Text Editor (RTE)
+
+The Rich Text Editor allows users to input and render HTML content. To prevent unsafe markup from being inserted or displayed, enable the built‑in sanitizer using the `EnableHtmlSanitizer` property.
+


how to disable the sanitization, if not needed.

blazor/common/security/input-sanitization.md

SyncfusionBuild · 2026-03-10T13:43:36Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-10T13:46:56Z

CI Status: FAILURE ❌
Source Compilation: SUCCESS ✅
Failure Reason: CI Failure with violation
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 1
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

SyncfusionBuild · 2026-03-10T13:49:34Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-10T13:52:05Z

CI Status: SUCCESS ✅
Source Compilation: SUCCESS ✅
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

kmkrish001 · 2026-03-10T14:03:42Z

blazor/common/security/input-sanitization.md

+
+{% previewsample "https://blazorplayground.syncfusion.com/embed/VXrxDAitJvkRyhWu?appbar=false&editor=false&result=true&errorlist=false&theme=bootstrap5" %}
+
+## Custom Sanitization


No content for this topic Custom Sanitization

SyncfusionBuild · 2026-03-10T14:05:52Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-10T14:07:32Z

CI Status: SUCCESS ✅
Source Compilation: SUCCESS ✅
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

SyncfusionBuild · 2026-03-10T14:26:24Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-10T14:28:04Z

CI Status: SUCCESS ✅
Source Compilation: SUCCESS ✅
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

kmkrish001 · 2026-03-11T07:24:52Z

blazor/common/security/input-sanitization.md

+
+@using Syncfusion.Blazor.BlockEditor
+
+<sfblockeditor enablehtmlsanitizer="true">


is this proper code to render block editor component in blazor ?

kmkrish001 · 2026-03-11T07:27:05Z

blazor/common/security/input-sanitization.md

+
+@using Syncfusion.Blazor.BlockEditor
+
+<sfblockeditor enablehtmlsanitizer="false">


is the property enablehtmlsanitizer casing is correct ?

kmkrish001 · 2026-03-11T07:27:43Z

blazor/common/security/input-sanitization.md

+
+* [Paste Clean-up in Blazor Rich Text Editor](https://blazor.syncfusion.com/documentation/rich-text-editor/paste-cleanup)
+* [Content Security Policy (CSP)](https://blazor.syncfusion.com/documentation/common/content-security-policy)
+* [Paste Clean-up in Blazor Blcok Editor](https://sfblazor.azurewebsites.net/staging/documentation/block-editor/paste-cleanup)


Block Editor spelling mistakes

kmkrish001 · 2026-03-11T07:37:13Z

blazor/common/security/input-sanitization.md

+    {
+        var cleaned = System.Net.WebUtility.HtmlEncode(UserText);
+        Items.Add(new ItemRecord { Content = cleaned });
+        Items = Items.ToList();


unnecessary list reassignment: The code calls Items.Add(...) then Items = Items.ToList(); and StateHasChanged(). This is confusing.

Action: Replace with a clear pattern. Keep Items as List and call Items.Add(...) then StateHasChanged().

kmkrish001 · 2026-03-11T07:39:38Z

blazor/common/security/input-sanitization.md

+```
+@code {
+    string userInput = "<script>alert('XSS')</script> Hello!";
+    string safeText = System.Net.WebUtility.HtmlEncode(userInput);


use System.Text.Encodings.Web.HtmlEncoder

kmkrish001 · 2026-03-11T07:40:27Z

blazor/common/security/input-sanitization.md

+
+* [Paste Clean-up in Blazor Rich Text Editor](https://blazor.syncfusion.com/documentation/rich-text-editor/paste-cleanup)
+* [Content Security Policy (CSP)](https://blazor.syncfusion.com/documentation/common/content-security-policy)
+* [Paste Clean-up in Blazor Blcok Editor](https://sfblazor.azurewebsites.net/staging/documentation/block-editor/paste-cleanup)


do not add staging link

kmkrish001 · 2026-03-11T07:41:46Z

blazor/common/security/input-sanitization.md

+
+## Built-In Sanitization Features
+
+Several Syncfusion Blazor components include HTML sanitization capabilities to prevent harmful script or markup from being processed. Components that accept or render HTML content such as the Rich Text Editor have built-in `EnableHtmlSanitizer` property to remove unsafe elements before rendering.


Mentioned several components but RTE and Block editor alone described, add short details about other components.

SyncfusionBuild · 2026-03-11T10:17:37Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-11T10:21:01Z

CI Status: SUCCESS ✅
Source Compilation: SUCCESS ✅
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

SyncfusionBuild · 2026-03-11T10:26:17Z

Build Status: INPROGRESS 🔃
Build Location: 1011008-sanitize

SyncfusionBuild · 2026-03-11T10:28:47Z

CI Status: SUCCESS ✅
Source Compilation: SUCCESS ✅
Build Location: 1011008-sanitize
Technical Error(s): 0
Spelling Error(s): 0
Image Alt Text Error(s): 0
Image Size Error(s): 0
Image Name Error(s): 0
Front matter Error(s): 0
File Path Error(s): 0
CodeSnippet File Path Missing Error(s): 0
Toc Anchor Tags Validation Error(s): 0
MD Tag Validation Error(s): 0

kmkrish001 · 2026-03-11T11:43:35Z

blazor/common/security/input-sanitization.md

+
+## Overview
+
+Input sanitization is a critical security practice in Syncfusion Blazor applications that handle user-generated content. Syncfusion Blazor components include built-in HTML sanitization (enabled by default in most cases) to safely process and render potentially untrusted content. This guide explains how these features work, focusing especially on the **Rich Text Editor**, **Block Editor** (using `EnableHtmlSanitizer` property), and **DataGrid**.


instead of saying most cases add example like, Syncfusion Blazor components that accept HTML have a built‑in sanitizer (for example, the Rich Text Editor's EnableHtmlSanitizer property is enabled by default).

kmkrish001 · 2026-03-11T11:45:17Z

blazor/common/security/input-sanitization.md

+{% endhighlight %}
+{% endtabs %}
+
+When enabled the `EnableHtmlSanitizer` property, automatically removes unsafe tags and attributes such as `<script>` tags, event attributes (such as onload, onclick), and other unsafe content before rendering it. This ensures only clean and safe HTML is allowed in the editor.


enabled the EnableHtmlSanitizer property - improvise the sentence.

kmkrish001 · 2026-03-11T11:51:27Z

blazor/common/security/input-sanitization.md

+
+When the EnableHtmlSanitizer property is enabled, the Block Editor automatically removes unsafe tags and attributes such as `<script>` tags, event attributes (like onload, onclick), javascript: URLs, and other harmful markup before rendering content. This ensures that only clean and trusted HTML remains in the editor output.
+
+To disable the built-in sanitizer (not recommended for untrusted input), set the property to false:


For disable example show in common section single place instead of each component.

kmkrish001 · 2026-03-11T11:53:18Z

blazor/common/security/input-sanitization.md

+@using Syncfusion.Blazor.Buttons
+@using Syncfusion.Blazor.Grids
+@using Syncfusion.Blazor.Inputs
+@using System.Text.Encodings.Web


File shows @using System.Text.Encodings.Web but example uses System.Net.WebUtility.HtmlEncode

kmkrish001 · 2026-03-11T11:55:27Z

blazor/common/security/input-sanitization.md

+
+@code {
+    string userInput = "<script>alert('XSS')</script> Hello!";
+    string safeText = System.Net.WebUtility.HtmlEncode(userInput);


@using System.Text.Encodings.Web

@code {
string userInput = "<script>alert('XSS')</script> Hello!";
string safeText = HtmlEncoder.Default.Encode(userInput);
}

kmkrish001 · 2026-03-11T11:56:31Z

blazor/common/security/input-sanitization.md

+<div class="input-row">
+    <SfTextBox @bind-Value="UserText" Placeholder="Enter text" CssClass="w-100"></SfTextBox>
+
+    <SfButton CssClass="e-primary" OnClick="ProcessInputAsync" Type="Button">


Button OnClick attribute uses "ProcessInputAsync" while the method is named ProcessInput (mismatch)

kmkrish001 · 2026-03-11T11:57:03Z

blazor/common/security/input-sanitization.md

+</div>
+
+<div class="mt-2">
+<SfGrid @ref="UserGrid" DataSource="Items" AllowPaging="true">


DataSource="Items" should be DataSource="@Items" (Razor binding)

1011008: Added New UG content for Input sanitization

d7cdc72

ponselvajeganathan added the cs:used AI was used in this PR label Mar 6, 2026

1011008: updated

663cb85

kmkrish001 requested changes Mar 6, 2026

View reviewed changes

1011008: Content updated

b806d0b

Merge branch 'development' into 1011008-sanitize

51061d3

kmkrish001 requested changes Mar 10, 2026

View reviewed changes

1011008: Modified content

f5c7f40

1011008: updated

d4be4c7

kmkrish001 reviewed Mar 10, 2026

View reviewed changes

1011008: updated

05c0f10

1011008: Added block editor code example

63b68fe

kmkrish001 requested changes Mar 11, 2026

View reviewed changes

1011008: modified

02078cf

1011008: updated

50337b6

kmkrish001 requested changes Mar 11, 2026

View reviewed changes


		## TextBox / TextArea

		Syncfusion TextBox and TextArea components bind plain text. Sanitize the value only if you render it as HTML.


		# Input Sanitization with Syncfusion Blazor Components

		Input sanitization ensures that any user-provided content whether typed, pasted, uploaded, or received from external sources is safe to process or display in a Syncfusion Blazor application. Because user input can contain unsafe HTML or script content, sanitization prevents malicious code execution and ensures application integrity.


		## Built-In Sanitization Features

		Several Syncfusion Blazor components include HTML sanitization capabilities to prevent harmful script or markup from being processed. Components that accept or render HTML content such as the Rich Text Editor have built-in mechanisms to remove unsafe elements before rendering.

		When enabled, automatically removes unsafe tags and attributes such as `<script>` tags, event attributes (such as onload, onclick), and other unsafe content before rendering it. This ensures only clean and safe HTML is allowed in the editor.

		## How to Sanitize Input in Blazor

		The encoded value ensures the Grid displays safe text without interpreting any malicious input.

		## See Also

		### Rich Text Editor (RTE)

		The Rich Text Editor allows users to input and render HTML content. To prevent unsafe markup from being inserted or displayed, enable the built‑in sanitizer using the `EnableHtmlSanitizer` property.


		{% previewsample "https://blazorplayground.syncfusion.com/embed/VXrxDAitJvkRyhWu?appbar=false&editor=false&result=true&errorlist=false&theme=bootstrap5" %}

		## Custom Sanitization


		@using Syncfusion.Blazor.BlockEditor

		<sfblockeditor enablehtmlsanitizer="true">


		@using Syncfusion.Blazor.BlockEditor

		<sfblockeditor enablehtmlsanitizer="false">


		## Overview

		Input sanitization is a critical security practice in Syncfusion Blazor applications that handle user-generated content. Syncfusion Blazor components include built-in HTML sanitization (enabled by default in most cases) to safely process and render potentially untrusted content. This guide explains how these features work, focusing especially on the Rich Text Editor, Block Editor (using `EnableHtmlSanitizer` property), and DataGrid.


		When the EnableHtmlSanitizer property is enabled, the Block Editor automatically removes unsafe tags and attributes such as `<script>` tags, event attributes (like onload, onclick), javascript: URLs, and other harmful markup before rendering content. This ensures that only clean and trusted HTML remains in the editor output.

		To disable the built-in sanitizer (not recommended for untrusted input), set the property to false:

Conversation

ponselvajeganathan commented Mar 6, 2026

Description

Code Studio usage(Mandatory)

Type of Change

Reviewer Checklist (Mandatory)

Uh oh!

SyncfusionBuild commented Mar 6, 2026

Uh oh!

SyncfusionBuild commented Mar 6, 2026

Uh oh!

SyncfusionBuild commented Mar 6, 2026

Uh oh!

SyncfusionBuild commented Mar 6, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kmkrish001 left a comment

Choose a reason for hiding this comment

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

SyncfusionBuild commented Mar 10, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!