I have a CloudPage with a form consisting of a text field. When the user submits on the form, the text field data is captured within a parameter and posted for processing on another Cloudpage. The purpose of the second page is to upsert the entry into a Data Extension.

All of the above works fine, however, my question relates to the step that is missing just before the data is inserted into a data extension. Does AMPScript have any specific functions for sanitizing string data before it is inserted into a Data Extension.

For example PHP has several functions for string sanitization such as,

filter_var($var, FILTER_SANITIZE_STRING)

Appreciate that frontend validation can also be used, but my query is specifically about in-built AMPScript functions as opposed to having to do the same thing with regex.

2 Answers 2


I'd focus on answering the question -- what constitutes invalid string data in your case? HTML tags? JavaScript? CR/LF?

Could be as simple as:


/* escape HTML tags */
set @inputStr= replace(replace(@inputStr,">","&gt;"),"<","&lt;")

/* bleep bad words */
set @inputStr = replaceList(@inputStr, "****", "apple", "macbook", "ipad", "ipod", "iphone")

/* replace line termination, form feed, tab, etc., control chars, */
set @inputStr = replaceList(@inputStr, "" , char(9), char(10), char(11), char(12), char(13))


You can also replace with matches returned from the RegexMatch() function.

If you don't like the AMPscript options, you can also try your hand at sanitizing in Server-Side JavaScript in your CloudPage. For example:

<script runat="server" language="JavaScript">
  Platform.Load("core", "1");
  var inputStr = bleepBadWords(inputStr);

  function bleepBadWords(s) {
    var BADWORDS = /\b(apple|macbook|ipad|ipod|iphone)\b/gi;
    return s.replace(BADWORDS, "****");




According to this answer, data is sanitized before it is inserted into a data extension (stored in DB). Please also consider adding headers to your cloud pages as described here.

<script runat=server>
   Platform.Response.SetResponseHeader("X-XSS-Protection","1; mode=block");
   Platform.Response.SetResponseHeader("Content-Security-Policy","default-src 'self'");

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .