---
schema_version: "1"
id: 4f5d72e70d4212c1c59b36bb6f7e13a6e284aa94a657303a48537f2998dbf229
title: Lightning Web Security Sanitization
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/lwc/lightning-components-security/guides/lws/lws-sanitize.md
canonical_url: https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: f0527b9afb0adf7c7161e6056f95802cde5d462ce3ba44fd5fab203326167115
products:
  - Security for Lightning Components
  - lwc
---
# Lightning Web Security Sanitization

Lightning Web Security (LWS) sanitizes content strings in HTML and SVG elements that your Lightning components inserted into the DOM. LWS examines the strings and removes content that poses a potential security risk. This sanitization process helps protect against cross-site scripting (XSS) attacks.

LWS uses an allowlist of elements and attributes that can remain in the DOM tree after sanitization.

LWS distortions on properties such as `innerHTML` and `setHTML` perform sanitization of strings. LWS can apply multiple distortions to some elements.

**important:** LWS doesn’t sanitize input text. It only filters HTML strings that components inserted into the DOM. Your code must validate or sanitize any user input.

**See Also**

- [HTML Allowlist for LWS](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize-html.md)
- [SVG Allowlist for LWS](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize-svg.md)
- [How LWS Sanitizes Static Resources in SVG Elements](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-sanitize-svg-static-resource.md)