remove HTML tags from user entry

[knuckle05]

Hi All,

I have a TEXTAREA field where users on my site will enter a personal bio. I want to disable them from entering HTML tags in there.

I know I could parse them out, but this could become a real pain. Is there any way to get the browser to just display the text as enetered? This would act at least as a deterrent, in that the HTML would not be processed...

thx !

 

[foxbox]

This makes the tags useless (but still in the text)

cText = request.form("textareaField&quot
cText = replace( cText, &quot;<&quot; , &quot;[&quot; )
cText = replace( cText, &quot;>&quot; , &quot;]&quot; )







hth,
Foxbox

 

[DSect]

I use Server.HTMLEncode:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/iissdk/iis/ref_vbom_seromhtenc.asp

You can do something like:

strYourVar = Server.HTMLEncode(Request.Form(&quot;txtYourTextArea&quot)

to parse HTML - or to neuter it so it displays as it was typed..

 

[DSect]

Try this to test:

strMytext = &quot;This has <B> HTML </B>&quot;
Response.Write(strMyText & &quot;<br>&quot;)
strMytext = Server.HTMLEncode(strMyText)
Response.Write(strMyText & &quot;<br>&quot;)

Output looks like:

This has HTML
This has <B> HTML </B>

 

[DSect]

Just to add one more thing -

Stripping HTML is *very important* for preventing Cross-Site Scripting attacks.

However you choose to do it, do it.

Read up on Cross-Site Scripting. It's a vulerability for most sites, because of the way they do things.

For instance, paste this in your textbox and submit or paste it into the middle of a querystring on one of your pages:

<script language='javascript'>alert(&quot;You Are Hacker Bait!&quot;);</script>

If you see the JS Box, you are vulnerable to Cross Site Scripting attacks..

If you are writing raw HTML to the browser - then you are vulnerable. Encode the user's input/output somewhere - either at the variables level or when it's writing something out to a browser.

Cross-Site Scripting and SQL Injection Attacks are the most prevalent vulnerablilties in people's web pages (not server - it's in the pages).

I suggest that you check into both of those as they can bite you in the butt sometime later..