remove html tags or script tags in c# string and also in client using javascript

问题

I need to do a user input validation, and I want it validated both in the client side and in the server side. I have ang textbox that the user can write his comment on the product, now what I wanted to do is to validate if his comment doesn't have any injections like html or javascripts. So what I wanted to do, after the user clicks on submit

1.) Client Side: How will I execute a validation like if the user inputs this kinds of string

<a href="">abcd</a> // I will accept only abcd and remove the anchor tag but the abcd should appear as a link
<script type="text/javascript">alert(123);</script> // I will accept only alert(123);as the valid string
<b>abcd</b> // I will display abcd but it must appear bold

2.) Server side: Same situation with the client side, I will remove the tags of the injected script and html tags. I am using sharepoint 2007, I'm not sure if there is a built-in function to do this kind of validation in sharepoint api or c# for the server side validation.

Note: I don't want to use RegEx for this or any third party software. I know many experts here can help me with this. Thank you so much!

回答1:

While RegEx is probably your best bet, you can use this and modify to your liking:

public static string StripHtml(this string source)
{
    string[] removeElements = new string[] { "a", "script" };
    string _newString = source;
    foreach (string removeElement in removeElements)
    {
        while (_newString.ToLower().Contains("<" + removeElement.ToLower()))
        {
            _newString = _newString.Substring(0, _newString.ToLower().IndexOf("<" + removeElement.ToLower())) + _newString.Substring(_newString.ToLower().IndexOf("</" + removeElement.ToLower() + ">") + removeElement.Length + 3);
        }
    }
    return _newString;
}

You'll use string clean = txtInput.Text.StripHtml();

回答2:

I am not sure about creating an validation for this. But you can programtically remove the tags using this function.

Use this function to remove the Html tage from the textbox value that user has input

public static string StripHtml(string html, bool allowHarmlessTags)
{
   if (html == null || html == string.Empty)
     return string.Empty; 

   if (allowHarmlessTags)
     return System.Text.RegularExpressions.Regex.Replace(html, "", string.Empty); 

   return System.Text.RegularExpressions.Regex.Replace(html, "<[^>]*>", string.Empty);
}

回答3:

If you want prevent javascript injection attacks just encode user input Server.HtmlEncode(message).
But if you need to clean some tags then Omar Al Zabir wrote good article Convert HTML to XHTML and Clean Unnecessary Tags and Attributes

// Encode the string input
StringBuilder sb = new StringBuilder(
                        HttpUtility.HtmlEncode(htmlInputTxt.Text));

// Selectively allow <b> and <i>
sb.Replace("&lt;b&gt;", "<b>");
sb.Replace("&lt;/b&gt;", "");
sb.Replace("&lt;i&gt;", "<i>");
sb.Replace("&lt;/i&gt;", "");
Response.Write(sb.ToString());

I also would like to recomand you check AntiSamy.NET project but I didn't try it by myself.

来源：https://stackoverflow.com/questions/4847538/remove-html-tags-or-script-tags-in-c-sharp-string-and-also-in-client-using-javas

标签

javascript

string

validation

user-input