escape vs sanitize

Benchmark created on

Preparation HTML

<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.1.6/purify.min.js" integrity="sha512-jB0TkTBeQC9ZSkBqDhdmfTv1qdfbWpGE72yJ/01Srq6hEzZIz2xkz1e57p9ai7IeHMwEG7HpzG6NdptChif5Pg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.21/lodash.min.js" integrity="sha512-WFN04846sdKMIP5LKNphMaWzU7YpMyCU245etK3g/2ARYbPK9Ub18eG+ljU96qKRCWh+quCY7yefSmlkQw1ANQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Setup

const strings = [...Array(100).keys()].map((i) => `"><iframe onload=alert(1)></iframe> Dragos${i}`)

Test runner

Ready to run.

Testing in
TestOps/sec
escape
strings.forEach(string => _.escape(string))
ready
sanitize
strings.forEach(string => DOMPurify.sanitize(string))
ready

Revisions

You can edit these tests or add more tests to this page by appending /edit to the URL.