Remove javascript links

Question

I'm looking for a regex that will be able to replace all links like <a href="javascript://potentiallybadstuff"> Link </a> with a warning. I've been having a play but no success so far! I've always been bad with regex, can someone point me in the right direction? I have this so far:

Edit: People saying don't use Regex - the HTML will be the output of a markdown parser with all HTML tags in the markdown stripped. Therefore i know that the output of all links will be formatted as stated above, therefore regex would surely be a good tool in this particular situation. I am not allowing users to enter pure HTML. And SO has done something very similar, try creating a javascript link, and it will be removed

<?php
//Javascript link filter test
if(isset($_POST['jsfilter'])){
    $html = "<a href=\"". $_POST['jsfilter']."\"> JS Link </a>";
    $pattern = "/ href\\s*?=\\s*?[\"']\\s*?(javascript)\\s*?(:).*?([\"']) /is";
    $replacement = "\"javascript: alert('Javascript links have been blocked');\"";
    $html = preg_replace($pattern, $replacement, $html);
    echo $html;
}
?>
<form method="post">
<input type="text" name="jsfilter" />
<button type="submit">Submit</button>
</form>

Don't. Just don't. It looks like you're accepting HTML tags. Accept BBCode instead. A tags isn't the only thing to worry about. There's also img tags, form tags, script tags and everything else that has onload attributes and such. — h2ooooooo
– h2ooooooo, Commented Jun 20, 2013 at 12:53
@h2ooooooo Well I'm accepting markdown with html tags stripped. I want links to be available, but just not javascript ones? I am not allowing any images or forms or scripts; just links — Adi Bradfield
– Adi Bradfield, Commented Jun 20, 2013 at 12:55

maphe · Accepted Answer · 2013-06-20 13:14:50Z

3

The right regex should be :

$pattern = '/href="javascript:[^"]+"/';
$replacement = 'href="javascript:alert(\'Javascript links have been blocked\')"';

answered Jun 20, 2013 at 13:14

maphe

1,9213 gold badges20 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Adi Bradfield Over a year ago

Thank you for answering the question, instead of criticizing :)

Garytje · Accepted Answer · 2013-06-20 12:54:55Z

1

Use strip_tags and htmlSpecialChars() to display user generated content. If you want to let users use specific tags, refer to BBcode.

answered Jun 20, 2013 at 12:54

Garytje

8745 silver badges11 bronze badges

1 Comment

Adi Bradfield Over a year ago

Just tested BBCode, and it does not block javascript links

Potsky · Accepted Answer · 2015-05-26 08:21:36Z

1

You should test quote and double quotes, handle white spaces, etc...

    $html = preg_replace( '/href\s*=\s*"javascript:[^"]+"/i' , 'href="#"' , $html );
    $html = preg_replace( '/href\s*=\s*\'javascript:[^i]+\'/i' , 'href=\'#\'' , $html );

answered May 26, 2015 at 8:21

Potsky

3282 silver badges9 bronze badges

Comments

Jahanzeb · Accepted Answer · 2013-06-20 13:21:33Z

0

Try this code. I think, this would help.

<?php
//Javascript link filter test
if(isset($_POST['jsfilter'])){
    $html = "<a href=\"". $_POST['jsfilter']."\"> JS Link </a>";
    $pattern = '/a href="javascript:(.*?)"/i';
    $replacement = 'a href="javascript: alert(\'Javascript links have been blocked\');"';
    $html = preg_replace($pattern, $replacement, $html);
    echo $html;
}
?>

answered Jun 20, 2013 at 13:21

Jahanzeb

6134 silver badges11 bronze badges

1 Comment

user5147563 Over a year ago

Are you sure about that? I lately made regex like this in script and it selected everything from the href string. You should use [^"]* instead of (.*?) as your server will think that the second quote is still in href.

Collectives™ on Stack Overflow

Remove javascript links

4 Answers 4

1 Comment

1 Comment

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

1 Comment

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related