removing javascript from user input fields?

[Anon]

i want to insure all javascript is removed for user input fields before it is submitted to the dbase.

what is the easiest/best way to do this?

TIA,
/frank

[Anon]

I guess if there is any way to do it, it will be to search for the two <scripts></script> tags and delete them and everything between.....

but if you are talking about a system whereby people paste a whole page worth of code into a textarea for you to then convert into a webpage....the catch will be that once you have deleted the script tags you will still have javascript functions being called from onMouseOvers, etc...and the page will show plenty of errors.

another way perhaps (but messy) would be to do a search and replace like:

$input = "your user input";
$input = ereg_replace("<script>","<!--",$input);
$input = ereg_replace("</script>","-->",$input);

cheeky but it might work...?
But you still have the other problem....that is if I am reading you right.

rgds,
scott d~

[Anon]

my main concern is anybody placing javascript into the field which is then saved to a dbase. this input is then called up from another page and any javascript will be executed in the page, or at the least cause a bunch of errors

(<script>onmouseover=test.this</script> crashed IE in the page)

I just want to REMOVE anything in between <script>/<javascriptX.XX> tags

will give that a shot and see how it works.

thanks,
/frank

[Anon]

I did something similar to this, and this should work...

// Get the javascript code from your document
$js_data = $your_document_data;
$js_data = eregi_replace(".<script", "", $js_data);
$js_data = eregi_replace("</script>.", "", $js_data);

// Replace the code with nothing in your document data. This replace code will, however, keep the <script> tags in the document, there will just be nothing inside them.

$your_document_data = ereg_replace("$js_data", "", $your_document_data;

Basicly, if anyone trys to put anything in <script> tags, it will delete it.

// This code will get rid of everything, including the script tags

$your_document_data = eregi_replace("<script . $js_data . </script>", "", $your_document_data);

This isn't tested, so there may be a few bugs.. I dunno.
Let me know

-Alex Augot
Teradyne, Inc

[Anon]

that worked, thanks!! I just changed the <script> tags into <!-- etc. and it worked like a charm. now javascript is commented out!

thanks,
/frank

[Anon]

removing <script> tags is good, but there's another way to inject javascript in form data. you can insert it in an anchor tag, like this:

<a href='javascript:alert("gotcha!");'>click me</a>

so be sure to check for that as well. (and if your audiences uses IE, be on the lookout for vbscript exploits)

-jacob