const sanitize = require("sanitize-html");

function sanitizeValue(value) {
  if (typeof value === "string") {
    return sanitize(value, {
      allowedTags: [],
      allowedAttributes: {},
    });
  }

  if (Array.isArray(value)) {
    return value.map(item => sanitizeValue(item));
  }

  if (value !== null && typeof value === "object") {
    const sanitizedObj = {};
    for (const key in value) {
      sanitizedObj[key] = sanitizeValue(value[key]);
    }
    return sanitizedObj;
  }

  return value; // numbers, booleans, null
}



module.exports = function sanitizeInput(req, res, next) {
  if (req.body) req.body = sanitizeValue(req.body);
  if (req.query) req.query = sanitizeValue(req.query);
  if (req.params) req.params = sanitizeValue(req.params);
  next();
};