const DANGEROUS_TAGS = ['script', 'iframe', 'object', 'embed', 'link', 'meta', 'base', 'form'];

export function sanitizeHtml(html) {
  if (!html || typeof html !== 'string') return '';

  let sanitized = html;

  DANGEROUS_TAGS.forEach((tag) => {
    const openClose = new RegExp(`<${tag}[\\s\\S]*?(?:<\\/${tag}>|/?>)`, 'gi');
    sanitized = sanitized.replace(openClose, '');
  });

  sanitized = sanitized.replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]*)/gi, '');
  sanitized = sanitized.replace(/(?:javascript|vbscript):/gi, '');

  return sanitized;
}

export function safeJsonParse(str, fallback = null) {
  if (!str) return fallback;
  try {
    return JSON.parse(str);
  } catch {
    return fallback;
  }
}