There is the jquery bashing again. let sanitizedHTML = $('<div>').text(unsanitizedHTML).html();