Sanitizing input fields in express app - mongodb

Question

I have several input fields for emails on my website. For these, I have 1 POST-route:
app.post('/', function(req, res){
Email.create(req.body.email, function(err, newEmail){
if(err){
console.log(err);
} else {
res.redirect('/');
};
});
});
The bootcamp I am learning from tells me that nefarious actors could use scripts in these inputs. However, when I try something like this:
<script>alert('test')</script>
nothing happens. In fact, it just gets added to my mongo database.
I installed express-sanitizer anyway as the bootcamp suggested and did this:
app.post('/', function(req, res){
req.body.email = req.sanitize(req.body.email);
Email.create(req.body.email, function(err, newEmail){
if(err){
console.log(err);
} else {
res.redirect('/');
};
});
});
However, when I do this and I input something I get an error stating 'ObjectParameterError' when I put in any string or script.
My app.use's look like this:
app.use(bodyParser.urlencoded({extended: true}));
app.use(expressSanitizer());
Any suggestions on how to best protect myself against scripts and how to implement express-sanitizer correctly?

Answer 1

It might be an issue with how you're doing the value changing.
I've done mine like this and it works:
const expressSanitizer = require('express-sanitizer')
let bodyParser = require('body-parser')
app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: true}))
//For Sanitising SQL
app.use(expressSanitizer())
And then when I want to sanitise:
//Pulling the sanitised values from request body
var name = req.sanitize(req.body.name)
var email = req.sanitize(req.body.email)

Answer 2

Instead of sanitizing entire object try to sanitize only the required one.
req.body.email = req.sanitize(req.body.email) should look like this req.body.email.yoursanitizationfield = req.sanitize(req.body.email.yoursanitizationfield);
req.body.email.yoursanitizationfield = req.sanitize(req.body.email.yoursanitizationfield);
Email.create(req.body.email, function(err, newEmail){
if(err){
console.log(err);
} else {
res.redirect('/');
};
});
});```

Answer 3

Can I suggest adding some debugging to get insights to program execution. Add a console.log(req.body.email); after req.body.email = req.sanitize(req.body.email); to see if that has worked? (Or indeed if the execution has even reached that point.)