Lutz, I should have been more clear in my original post. You are correct about the valid HTML. I already sanitize the output by escaping the characters as you show.
The issue is that I have no control over the input. I am looking for something that will strip tags before the text is stored in the database, or that can be used for input validation. I'm in the process of securing some older web apps that have a lot of <textarea> free text fields. The customer would like to filter out any potentially malicious input (think cross-site scripting). To really do what I want I'd need to match all potential tags, then run each one through some code that would decide if the "tag" was really a tag. Given the example I showed, that isn't easily solved. I may need to rethink my strategy. Thanks for the help though, Brad Lutz Epperlein wrote: > Brad Perkins wrote: >> Lutz Epperlein wrote: >>> You can try to implement this reg ex: <\/\?[^>]\+> > >> That will actually strip text that isn't an html tag, but sort of looks >> like one. It can also remove text from mathematical formulas. For >> example, >> >> (a < b) | ( b > 1000) >> >> ends up as >> >> (a 1000) > > You can't wrote such text in an html file. This is not valid html > code. You will get rendering errors probably. > > Your formula should look like this in html: > > (a < b) | ( b > 1000) > > Then the regex will work. > > > Regards > Lutz > _______________________________________________ Active4D-dev mailing list [email protected] http://mailman.aparajitaworld.com/mailman/listinfo/active4d-dev Archives: http://mailman.aparajitaworld.com/archive/active4d-dev/
