If you want to block users from running any JavaScript code inside the editor or within the HTML tool, you can enable Unlayer’s built-in Safe HTML mode.
This feature ensures that no scripts or inline event handlers are executed — keeping your editor environment secure from potential code injection or malicious scripts.
How to Enable Safe HTML
Add the safeHtml property to your unlayer.init() configuration:
unlayer.init({
safeHtml: true
});Once enabled, the editor will automatically sanitize any HTML content added by end-users, removing all JavaScript or unsafe attributes.
When to Use Safe HTML
Enable Safe HTML when:
End-users have access to the HTML tool or can insert custom code.
the application is public-facing or multi-tenant.
To prevent accidental or intentional injection of malicious code