Email HTML is written by strangers and delivered to your browser. Without sanitisation it is an attack surface: scripts can steal data, iframes can load phishing pages, event handlers can execute code on interaction, and tracking images can beacon your location. A good sanitiser removes all of these before the markup ever reaches your browser.
Common threats in HTML email
- Script injection —
<script>tags orjavascript:URLs in href/src attributes that execute in the reader's browser. - Event handler injection —
onmouseover,onclick,onerrorand similar attributes that execute JavaScript without an explicit<script>tag. - Iframe embedding — frames that load external content, including phishing pages, inside the email view.
- Object and embed tags — legacy plugin content that can execute native code.
- CSS exfiltration — carefully crafted CSS that leaks information about the user's browser via external font or background-image requests.
- Tracking pixels — remote images that log opens, IP addresses, and device information.
What sanitisation removes
Before any message is stored on EmailGenerator.pro, the HTML is passed through an allowlist-based sanitiser. It removes:
- All
<script>elements - All
<iframe>,<object>,<embed>,<form>and<input>elements - All event handler attributes (
on*) - All
javascript:anddata:URL schemes inhrefandsrc - All remote images —
<img src="...">tags are replaced with inert placeholders
Why a sandboxed frame still matters
No sanitiser is perfect. Rendering the surviving markup inside an <iframe sandbox> adds a second layer: even if a sanitiser edge case lets something through, the sandbox prevents it from accessing the parent page's cookies, JavaScript context, or storage.
Questions
Why are remote images blocked rather than just sanitised?
Because loading a remote image is itself a tracking action — it fires an HTTP request with your IP and timestamp. Blocking the request is the only way to prevent the beacon from firing.
Does sanitisation affect plain text emails?
No. Plain text parts contain no HTML, so there is nothing to sanitise. They are rendered as-is inside the sandboxed frame.