delete any event javascript from a string

Question

Is there an easy way to remove with php any type of event HTML in php string. For example for events submit,mouseOut,mouseOver,click,blur,focus,etc. to prevent javascript injection, for cases like these: is There an easy way to remove with php any type of event HTML in php srtring. For example for events submit,mouseOut,mouseOver,click,blur,focus,etc. to prevent javascript injection, for cases like these:

$text= 'mi secure html <div id="javascript_injection" onfocus=function(){SomeJavaScriptCode}></div> <p> Im interested in showing the resulting html </p>'

echo $text = 'mi secure html <div id="javascript_injection" > example </div> <b> Im interested in showing the resulting html </b>

I'm also interested in showing this:

'mi secure html <div id="javascript_injection" > example </div> <b> Im interested in showing the resulting html </b>

PD:I can not escape all the text or remove all tags because there are parts that if I want to show in html.Imagine you want to show a user creates html to another and want to avoid the injection of javascript

If your code can be "hacked" through javascript, then you better change the code... — Peon
– Peon, Commented Jan 22, 2013 at 12:17
Im sorry,I was editing when you answered the question, It just republish Pay attention to the bold. — Martin
– Martin, Commented Jan 22, 2013 at 12:25
If you want to allow img elements, you should check src (and other non-obvious constructs) as well, as it may contain JavaScript. There are many other edge cases as well. See XSS cheat sheet. As Wayne Whitty already said, where is this text coming from? — Marcel Korpel
– Marcel Korpel, Commented Jan 22, 2013 at 12:32
@MarcelKorpel A DOMDocument based solution should work just fine though, unless I'm missing something obvious. — Ja͢ck
– Ja͢ck, Commented Jan 22, 2013 at 12:44

Ikke · Accepted Answer · 2013-01-22 12:48:43Z

4

The best way to solve this kind of problem is through whitelisting instead of blacklisting. The idea is that you define what tags / attributes you allow, instead of trying to filter out bad things.

A good library that handles this is http://htmlpurifier.org/. You can customize it to make it allow the things you want to keep.

require_once '/path/to/HTMLPurifier.auto.php';

$dirty_html = '<a href="test.html" onclick="alert()">Test</a>'

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($dirty_html);

echo $clean_html

Output:

<a href="test.html">Test</a>

answered Jan 22, 2013 at 12:48

Ikke

102k23 gold badges101 silver badges121 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Marcel Korpel Over a year ago

Looks great, but does it disallow <img src="javascript:alert(0)">?

Ikke Over a year ago

There is a demo page to test: htmlpurifier.org/demo.php (It filters out the entire tag)

Marcel Korpel Over a year ago

I'm not going to manually test every edge case, but it does a pretty good job indeed.

Ikke Over a year ago

Here is a list with tests: htmlpurifier.org/live/smoketests/xssAttacks.php

Collectives™ on Stack Overflow

delete any event javascript from a string

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related