perl regular exp prevent cross site scripting

[rakeshou]

Hi gurus,

What can be the perl regular expression that replaces the <script></sript> tags and anything between them with blank space
currently I am doing soemthing like this,

$comments =~ s!<script||javascript||vbscript||(../)||</script>!!ig;

but this just removes the <script tags

Thank you

 

[KevinADC]

see how this works:

$comments =~ s/(<[\s\/]*)(script\b[^>]*>)/$1XXX$2/gi;
while ($comments =~ s/(<[^>]*?)\b(on\w+\s*=)/$1XXX$2/gi) {}

it doesn't remove the scripting stuff but it should disable it by putting 'XXX' before the tagname/attribute. So:

<script language="javascript>

would become:

<XXXscript language="javascript>

and

<img src="frog.jp" onMouseOver="alert('JUMP YOU GREEN FROG!')">

should become:

<img src="frog.jp" XXXonMouseOver="alert('JUMP YOU GREEN FROG!')">

- Kevin, perl coder unexceptional!

 

[ishnid]

Or you could use HTML::TagFilter