how to prevent adding scripts in input fields

Question

I need to prevent adding scripts inside input fields.is there any way to prevent adding javascript codes in text fields/text areas?

function filter($event) {
    var regex = /[^a-zA-Z0-9_]/;
    let match = regex.exec($event.target.value);
    console.log(match);
    if (match) {
        $event.preventDefault();
    } else {
        return true;
    }
}

So you want to stop the user from entering code that could potentially be run? Just sanitize it and replace any characters (parentheses, quotes, etc) with an encoded version instead of the literal string. — Jack Bashford
– Jack Bashford, Commented Jun 16, 2022 at 9:05
@Basta No, I don't think that's the case - I believe OP wants users to not be able to enter JS code in an input. — Jack Bashford
– Jack Bashford, Commented Jun 16, 2022 at 9:05
@JackBashford yes, I want to stop pasting or type javascript codes in Html input fields — gayan nad
– gayan nad, Commented Jun 16, 2022 at 9:14
Well then you have to have some way to detect if a string is a JavaScript code fragment (which is incredibly difficult, IMHO - just block specific characters like ()[]{}; and you should have some small success (not much you can do without them as far as I can think right now). — Jack Bashford
– Jack Bashford, Commented Jun 16, 2022 at 9:17

Alan · Accepted Answer · 2023-10-23 04:41:11Z

1

Using the xss package works well (https://github.com/leizongmin/js-xss)

With nodeJs:

var xss = require("xss");
var html = xss('<script>alert("xss");</script>');
console.log(html);

With HTML file

<script src="https://rawgit.com/leizongmin/js-xss/master/dist/xss.js"></script>
<script>
  // apply function filterXSS in the same way
  var html = filterXSS('<script>alert("xss");</scr' + "ipt>");
  alert(html);
</script>

answered Oct 23, 2023 at 4:41

Alan

10.3k4 gold badges59 silver badges75 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rohìt Jíndal · Accepted Answer · 2022-06-16 12:38:25Z

You can sanitize the input by defining the blacklist regex which contains the patterns not allowed by the input and then replaced the part of input string with empty string if matched with the blacklist regex.

For now I just added a simple blackList regex (You can modify it as per your requirement) which will replace all the text comes between < and >. For Ex: If user enter <script>Hello</script> (This whole input text will get replaced with the empty string on keyup event.

const blackList = /<+>/ig

function sanitizeInput() {
  const inputStr = document.getElementById('inputStr').value;
  console.log('inputStr', inputStr)
  document.getElementById('result').innerHTML = inputStr?.replace(blackList, '')
}

<input type="text" id="inputStr" onkeyup="sanitizeInput()"/>

<div id="result"></div>

hemant rao · Accepted Answer · 2023-04-20 07:10:49Z

0

here I have found the solution, I think it will work.

input.replace(/</g, "<").replace(/>/g, ">").replace(/=/g, "equal;");

answered Apr 20, 2023 at 7:10

hemant rao

3,3332 gold badges16 silver badges14 bronze badges

Collectives™ on Stack Overflow

how to prevent adding scripts in input fields

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related