is there a package in the standard library for sanitizing text?

I'm trying to strip things like \n, >, etc from comments I retrieved from the reddit API. What is the standard way to achieve this?

---

评论：

rz2yoj:

The standard way to get comments from the Reddit API without the escaping is to use the "raw_json" query string parameter.

For example: https://www.reddit.com/user/kjnkjnkjnkjnkjnkjn.json?raw_json=1

manifold360:

bluemonday

nesigma:

Is there any reason using bluemonday when using html/template which already escapes dangerous characters?

1lann:

html/template escapes everything, bluemonday only escapes XSS. The differences are detailed in its README.

nesigma:

Okay so since html/template also covers XSS there no reason to use bluemonday on top.

1lann:

Yes it would be pointless to use bluemonday on top of html/template. You would only use bluemonday by itself to escape HTML (and then possibly pass it to html/template as type template.HTML).

broady:

Use the html/template package.

If you don't need templating, you can just use the html package. (html.EscapeString)

If you mean to strip tags, then you probably want to check out x/net/html or goquery

magpiecub:

If you're just removing arbitrary strings then I think you want strings.Replace or regexp.

arp242:

Probably not a good idea to "roll your own" HTML escaping code, especially not if the input is untrusted (like Reddit comments).

magpiecub:

Sanitizing and escaping are two totally different concepts. OP is asking about sanitizing.

If they only need to strip newlines and things that look like HTML character entity references, then regexp should work fine.

arp242:

OP isn't 100% clear on what the input looks like, but mention of > makes it sound like there could be embeded HTML in there.

I would expect that the Reddit API removes most of the truly harmful  and onload=.. stuff, but you can never be sure.

Either way, I don't really see a downside to using an established library; so why not use it, just to be on the safe side?

relvae:

And regexp is super slow