Make sure user doesn't put in malicious html in code

Question

I'm using a textarea to get input from the user and display it on the screen. How can I make sure that if they put in something like

<h1>YAY, I hacked in</h1>

I only display it as it is, and it doesn't display as an <h1>. There must be a function for this. Help? :D

Check the following question: stackoverflow.com/questions/129677/… — Kristian Vitozev
– Kristian Vitozev, Commented May 28, 2013 at 14:00
Use a XML Parser on your server and strip / validate the input. You don't use RegEx, do you!? — jAndy
– jAndy, Commented May 28, 2013 at 14:02
Create a text node, set its value as the user's input, and then append it to the page — Ian
– Ian, Commented May 28, 2013 at 14:02
possible duplicate of What are the common defenses against XSS? — Quentin
– Quentin, Commented May 28, 2013 at 14:04
be careful: sanitising/validating in the browser can be bypassed fairly easily if someone wants to hack you. You must also do similar checks in your server-side code as well. — Spudley
– Spudley, Commented May 28, 2013 at 14:24

Florian Margaine · Accepted Answer · 2013-05-28 14:21:53Z

2

As I commented, if you're about to send that data to a server, you should use one of the various XML Parsers available and strip + validate the input.

If you however, need to purely validate on the client, I suggest you use document.implementation.createHTMLDocument, which creates an fully fledged DOM Object on the stack. You can then operate in there and return your validated data.

Example:

function validate( input ) {
    var doc   = document.implementation.createHTMLDocument( "validate" );

    doc.body.innerHTML = input;

    return [].map.call( doc.body.querySelectorAll( '*' ), function( node ) {
        return node.textContent;
    }).join('') || doc.body.textContent;
}

call it like

validate( "<script>EVIL!</script>" );

edited May 28, 2013 at 14:21

Florian Margaine

61.2k15 gold badges94 silver badges120 bronze badges

answered May 28, 2013 at 14:19

jAndy

237k57 gold badges313 silver badges363 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Florian Margaine Over a year ago

How is using document.implementation.createHTMLDocument better than using a plain DOM element or a document fragment?

jAndy Over a year ago

@FlorianMargaine its in fact very similar to a document fragment. However you can use anything in here, that you would do in your default document. You can literally load entire HTML documents into this thing and operate on it. Should be way more lightweight than an <iframe> at least.

svidgen · Accepted Answer · 2013-05-28 14:35:21Z

1

You need to address this on the server side. If you filter with JavaScript at form submission time, the user can subvert your filter by creating their own page, using telnet, by disabling JavaScript, using the Chrome/FF/IE console, etc. And if you filter at display time, you haven't mitigated anything, you've only moved the breakin-point around on the page.

In PHP, for instance, if you wish to just dump the raw characters out with none of the user's formatting, you can use:

print htmlentities($user_submitted_data, ENT_NOQUOTES, 'utf-8');

In .NET:

someControl.innerHTML = Server.HtmlEncode(userSubmittedData);

If you're trying to sanitize the content client-side for immediate/preview display, this should be sufficient:

out.innerHTML = user_data.replace(/</g, "&lt;").replace(/>/g, "&gt;");

edited May 28, 2013 at 14:35

answered May 28, 2013 at 14:28

svidgen

14.4k4 gold badges37 silver badges60 bronze badges

3 Comments

svidgen Over a year ago

Bear in mind, the last suggestion doesn't sanitize the text for sending to other visitors. It's only legitimate purpose is for giving the text-entering user an accurate pre-submission preview of their entry.

taevanbat Over a year ago

Okay. If you're using a PHP form and submitting the information via GET, mysql_real_escape_string would be a legitimate way to sanitize the string, right?

svidgen Over a year ago

It's a legitimate way to sanitize a string for interpolation in a [My]SQL query. You still need to perform HTML/JavaScript sanitization on inserted values before sending them to the client.

Collectives™ on Stack Overflow

Make sure user doesn't put in malicious html in code

2 Answers 2

2 Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related