PHP - Regex to remove all occurences of event attributes

Question

after hours of trying i'm here to ask. i want to remove all the occurences of js event attributes and style attribute from POSTed text. it may or may not contain new lines.

Posted example text:

<a href="http://www.google.com" onclick="unwanted_code" style="unwanted_style" ondblclick="unwanted_code" onmouseover="unwanted_code">google</a> is a search engine. There are other engines too. <a href="http://www.yahoo.com" onclick="unwanted_code" ondblclick="unwanted_code" onmouseover="unwanted_code" style="unwanted_style">yahoo</a> is another engine.

first try:

$pattern[0] = '/(<[^>]+) on.*=".*?"/iU';
$replace[0] = '$1';
$pattern[1] = '/(<[^>]+) style=".*?"/iU';
$replace[1] = '$1';
$out = preg_replace($pattern, $replace, $in);

output:

<a href="http://www.google.com">yahoo</a> is another engine.

second try:

$out = preg_replace_callback('/(<[^>]+) on.*=".*?"/iU', function($m) {return $m[1];}, $in);

output:

<a href="http://www.google.com">yahoo</a> is another engine.

output i'm trying to get is:

<a href="http://www.google.com">google</a> is a search engine. There are other engines too. <a href="http://www.yahoo.com">yahoo</a> is another engine.

anyone helping me out?

You're probably best using some form of HTML filtering (HTMLPurifier comes to mind) and set what tags and attributes are allowed. — froddd
– froddd, Commented Feb 24, 2014 at 8:58
An answer here: Remove on* JS event attributes from HTML tags, altho it doesn't include style it's easy to add if you really want the regex solution. — Qtax
– Qtax, Commented Feb 24, 2014 at 9:15
How are you going to combat people introducing <script> tags? — Ja͢ck
– Ja͢ck, Commented Feb 24, 2014 at 11:19

Toto · Accepted Answer · 2014-02-24 09:08:46Z

3

How about:

$content = '<a href="http://www.google.com" onclick="unwanted_code" style="unwanted_style" ondblclick="unwanted_code" onmouseover="unwanted_code">google</a> is a search engine. There are other engines too. <a href="http://www.yahoo.com" onclick="unwanted_code" ondblclick="unwanted_code" onmouseover="unwanted_code" style="unwanted_style">yahoo</a> is another engine.';

$result = preg_replace('%(<a href="[^"]+")[^>]+(>)%m', "$1$2", $content);
echo $result,"\n";

output:

<a href="http://www.google.com">google</a> is a search engine. There are other engines too. <a href="http://www.yahoo.com">yahoo</a> is another engine.

answered Feb 24, 2014 at 9:08

Toto

91.7k63 gold badges97 silver badges135 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Ja͢ck · Accepted Answer · 2014-02-24 11:12:55Z

Even thought the question is tagged as regex, I'm adding this answer anyway, because it's more robust for input validation; this particular solution only accepts certain tags and restricts the allowed attributes:

$doc->loadHTML('<html><body>' . $html . '</body></html>');

$allowedTags = ['a' => ['href']];

$body = $doc->getElementsByTagName('body')->item(0);

$elements = $body->getElementsByTagName('*');
for ($k = 0; $element = $elements->item($k); ) {
    $name = strtolower($element->nodeName);
    if (isset($allowedTags[$name])) {
        $allowedAttributes = $allowedTags[$name];
        for ($i = 0; $attribute = $element->attributes->item($i); ) {
            if (!in_array($attribute->nodeName, $allowedAttributes)) {
                $element->removeAttribute($attribute->nodeName);
                continue;
            }
            ++$i;
        }
    } else {
        $element->parentNode->removeChild($element);
        continue;
    }
    ++$k;
}

$result = '';

foreach ($body->childNodes as $childNode) {
    $result .= $doc->saveXML($childNode);
}

echo $result;

hattila · Accepted Answer · 2014-02-24 09:06:11Z

0

Since you want to preserve an attribute (href), you cannot delete them all. With this code you can achieve what you want, but with listing all the unwanted attributes:

preg_replace('#(onclick|style|ondblclick|onmouseover)="[^"]+"#', '', $in);

Maybe it can be simplyfied but this just works :)

answered Feb 24, 2014 at 9:06

hattila

5005 silver badges13 bronze badges

7 Comments

ThunderX Over a year ago

yes that way it works but i tried to do away with one elegant regex. furthermore you have to include all other events (like onchange onmouseout etc.). another thing i learned but didnt understand is that if i remove U modifier it only removes one "on.*" attribute even if in the text there are 10.

ThunderX Over a year ago

one more thing my original regex removes some text that is in between two matches which it shouldnt remove. i didnt get that too.

Qtax Over a year ago

No no, plenty of issues here, eg: <a onclick = "alert('lol')">1</a>, see stackoverflow.com/a/9466152/107152 for a more comlete regex. ;-)

ThunderX Over a year ago

my aim is for malicious code. because normal users wouldnt craft bad POST content. they just write and post.

hattila Over a year ago

A more simplified version: preg_replace('/(on.*?|style)=".*?"/', ' ', $in)

|

Collectives™ on Stack Overflow

PHP - Regex to remove all occurences of event attributes

3 Answers 3

Comments

Comments

7 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

7 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related