. NET implement script markup cleanup function code

Web page editors are often used in today's Web pages because people need to insert HTML code content such as images, videos, and styles into a Web page, which makes the information richer. It also brings a lot of trouble to program developers because unsafe tags and illegal tags such as script, such as unknown tags, are unavoidable in the HTML submission. This requires us to write a large number of program code to analyze the specified user-submitted HTML information security, standards.

Method 1:

Today I would like to recommend a component, he can intelligently analyze the error part of the code and clear the error section, and the configuration is relatively simple. His name is Safehelper, and he will clear and check out the tags that are not allowed to appear, by setting the tag in the config file. The use of the method is fairly straightforward and requires only a static method to be called.


The first step is to create a new file named "Wuxiu." Htmlanalyserconfig.xml "XML file to the Web site with the directory, and add the following code:

<?xml version= "1.0" encoding= "Utf-8"? >
The second step, add DLL reference, safehelper official website: http://www.wuxiu.org/downloads.html

In the third step, the following code is called to clear the unknown tag in HTML (Wuxiu. All tags not defined in Htmlanalyserconfig.xml):

String html = "<script>alert (' yes ');</script><p>content</p>"; html = Wuxiu. SafeHelper.HtmlSafer.HtmlSaferAnalyser.ToSafeHtml (HTML); Response.Write (HTML);

or check all unknown tags

String html = "<script>alert (' yes ');</script><p>myhtmlcontent</p>"; string [] dangers = Wuxiu. SafeHelper.HtmlSafer.HtmlSaferAnalyser.ValidHtml (Html,false); foreach (string Danger_tag in dangers) {    Response.Write (danger_tag+ "<br/>");}
Clear All HTML tags
String Text=wuxiu. SafeHelper.HtmlSafer.HtmlSaferAnalyser.ClearHtmlTags ("<p>hello world</p>");
Method Two, match the script hazard token with a regular expression:
public static string striphtml (String strhtml) {String[]aryreg = {@ ' <script[^>]*?>.*?</script> ' , @ "< (\/\s*)?!? (\w+:) \w+) (\w+ (\s*=?\s* ([""]) (\\["" tbnr]|[ ^\7]) *?\7|\w+) |. {0}) | \s) *?        (\/\s*)?> "@" ([\ r \ n]) [\s]+ ", @" & (quot| #34); "@" & (amp| #38); "@" & (lt| #60); "@" & (gt| #62); "@ "& (nbsp| #160)," @ "& (iexcl| #161)," @ "& (cent| #162)," @ "& (pound| #163);" @ "& (copy| #169);    "@" (\d+), @ "-and" @ "<!--. *\n"};      String[]aryrep = {"", "" "," "," \ "", "&", "<", ">", "", "\xa1",//CHR (161), "\xa2",//CHR (162),    "\xa3",//CHR (163), "\xa9",//CHR (169), "", "\ r \ n", ""};    String newreg = Aryreg[0];    string stroutput = strHTML;      for (int i = 0; i < aryreg.length; i++) {regex regex = new Regex (Aryreg[i], regexoptions.ignorecase); Stroutput = Regex.    Replace (Stroutput, aryrep[i]);    } stroutput.replace ("<", ""); StrOutput.replace (">", "");    Stroutput.replace ("\ r \ n", ""); return stroutput;}