Disable Javascript execution in textarea

Question

I have a textarea in my web application where user can enter any thing and it will save it as string in db. In case user enter some Javascript code in textarea then it will execute when we try to see it in saved data page. Is there any generic way to prevent this.

Which framework are you using for your application?

Dragondraikk
– Dragondraikk

2015-05-05 10:52:47 +00:00
Commented May 5, 2015 at 10:52 — Dragondraikk
– Dragondraikk, Commented May 5, 2015 at 10:52

Anders Ekdahl · Accepted Answer · 2015-05-05 11:12:49Z

1

You should never display input from a user without escaping it. You'd take the input the user gives you and store it as is, but when you display it again, you have to do proper escaping. Just manually stripping out <script> is not enough.

There are numerous ways of escaping content depending on the framework/platform you're using, and such functionality is probably even built into the templating solution you're using.

EDIT

I'm not familiar with the Stripes framework, but after a quick Google search this turned up: http://stripes.sourceforge.net/docs/current/javadoc/net/sourceforge/stripes/util/HtmlUtil.html

edited May 5, 2015 at 11:12

answered May 5, 2015 at 11:00

Anders Ekdahl

23k4 gold badges73 silver badges61 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

yusuf Over a year ago

somebody inserted below as first name and then whenever we open web page it will give pop uo. Is there any generic way in stripes to prevent this. <script>alert(1);</script>

Anders Ekdahl Over a year ago

Edited my response with a possible solution.

Collectives™ on Stack Overflow

Disable Javascript execution in textarea

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related