Skip to main content
Version: 6.8.0

Sanitization middlewares

These methods are all available via require('express-validator').

These sanitization-only middlewares have been deprecated, as the validation middlewares offer the same functionality, and much more. They will be removed eventually.

sanitize(fields)

  • field: a string or an array of strings of field names to validate against.

Returns: a Sanitization Chain

Prefer using check() instead. This function has been deprecated.

Creates a sanitization chain for one or more fields. They may be located in any of the following request objects:

  • req.body
  • req.cookies
  • req.params
  • req.query

* req.headers is not supported at the moment.

If any of the fields are present in more than one location, then all instances of that field value will be sanitized.

sanitizeBody(fields)

Same as sanitize(fields), but only sanitizing req.body.

Prefer using body() instead. This function has been deprecated.

sanitizeCookie(fields)

Same as sanitize(fields), but only sanitizing req.cookies.

Prefer using cookie() instead. This function has been deprecated.

sanitizeParam(fields)

Same as sanitize(fields), but only sanitizing req.params.

Prefer using param() instead. This function has been deprecated.

sanitizeQuery(fields)

Same as sanitize(fields), but only sanitizing req.query.

Prefer using query() instead. This function has been deprecated.

buildSanitizeFunction(locations)

  • locations: an array of request locations to gather data from.
    May include any of body, cookies, params or query.

Returns: a variant of sanitize() sanitizing the given request locations.

Prefer using buildCheckFunction() instead. This function has been deprecated.

Creates a variant of sanitize() that sanitizes the given request locations.

const { buildSanitizeFunction } = require('express-validator');
const sanitizeBodyAndQuery = buildSanitizeFunction(['body', 'query']);

app.put('/update-product', [
// id being either in req.body or req.query will be converted to int
sanitizeBodyAndQuery('id').toInt()
], productUpdateHandler)