diff --git a/app/utils/sanitizeInput.js b/app/utils/sanitizeInput.js
new file mode 100644
index 0000000..c843d20
--- /dev/null
+++ b/app/utils/sanitizeInput.js
@@ -0,0 +1,31 @@
+const sanitize = require("sanitize-html");
+
+function sanitizeValue(value) {
+  if (typeof value === "string") {
+    return sanitize(value, {
+      allowedTags: [],
+      allowedAttributes: {},
+    });
+  }
+
+  if (Array.isArray(value)) {
+    return value.map(item => sanitizeValue(item));
+  }
+
+  if (value !== null && typeof value === "object") {
+    const sanitizedObj = {};
+    for (const key in value) {
+      sanitizedObj[key] = sanitizeValue(value[key]);
+    }
+    return sanitizedObj;
+  }
+
+  return value; // numbers, booleans, null
+}
+
+module.exports = function sanitizeInput(req, res, next) {
+  if (req.body) {
+    req.body = sanitizeValue(req.body);
+  }
+  next();
+};
diff --git a/server.js b/server.js
index 408ee33..8a1f48a 100644
--- a/server.js
+++ b/server.js
@@ -8,15 +8,22 @@ const routes = require("./app/routes/routes");
 const db = require("./app/models");
 const path = require("path");
 const cookieParser = require("cookie-parser");
+const sanitizeInput = require("./app/utils/sanitizeInput");
 require("dotenv").config();
  
 const app = express();
 
-
+// GLOBAL MIDDLEWARE (body parsing)
 app.use(express.json());
-app.use(helmet());
-app.use(morgan("dev"));
 app.use(cookieParser());
+app.use(
+  helmet({
+    contentSecurityPolicy: false,
+  })
+);
+app.use(morgan("dev"));
+app.use(sanitizeInput);
+
 // app.use(cors());
 const allowedOrigins = [
   "http://localhost:5173/",     //local