Re: Checking forms for JavaScript

I'm not sure if there's any way to pick javascript code out of some random block of text without doing some serious linguistic analysis.

What's your objective here? I'm guessing you have some stuff from a web form that's going to go back onto a web page, and you don't want to allow any potentially nasty javascript. Based on that assumption...

You could take the easy way out and just strip anything that looks like an HTML tag. Or you could strip out <script> tags, the string 'javascript:', and any html tag attributes that have to do with javascript (onClick, onMouseOver, etc.).

Not being a javascript wiz, I'm sure I haven't covered everything, but this ought to give you a start. You might get more useful answers if you can post more details of what you're trying to accomplish with this code.

Update: corrected para 3. Of course I meant strip out <script> tags

Comment on Re: Checking forms for JavaScript

Replies are listed 'Best First'.
Re: Re: Checking forms for JavaScript by Sullust (Acolyte) on Jul 24, 2001 at 06:59 UTC
That's exactly what I'm trying to do. I just don't want the nefarious citizens of the net to be sticking unpleasant scripts in my database ;) I appologize for not being more specific. Anyway, those suggestions look very promissing. I thank you for your help. I'm not so much interested in completely removing scripts, as making them inoperable and having something warn me about a potentially script laden post. I suppose I should have been more specific about that as well. Thanks again for the help.	[reply]

Replies are listed 'Best First'.

Re: Re: Checking forms for JavaScript
by Sullust (Acolyte) on Jul 24, 2001 at 06:59 UTC

That's exactly what I'm trying to do. I just don't want the nefarious citizens of the net to be sticking unpleasant scripts in my database ;) I appologize for not being more specific. Anyway, those suggestions look very promissing. I thank you for your help. I'm not so much interested in completely removing scripts, as making them inoperable and having something warn me about a potentially script laden post. I suppose I should have been more specific about that as well. Thanks again for the help.

[reply]