RE: FN-FORUM: Function to strip out HTML from data

date posted 8th October 2007 15:27

Quoting "Ben Johnson (Neogic) F" [EMAIL REMOVED]

> Dave wrote:
>> All of those links go to articles that recommend using regular
>> expressions to strip the tags. And they all seem to be using
>> regular expressions that break on the most trivial of HTML.
>>
>> " />
>>
>> Surely there's a better approach in ASP.
>
>
> I bumped up against this recently - as you mentioned, the problem is lack =
of
> contextual matching within regular expressions, which would allow us to
> distinguish between a tag "" and brackets within tag attributes
> (" b) alert()'>").
>
> I came up with a harder to break Reg Exp, but it's still not perfect:
>
> =09/(?![^)/g
>
> This matches start/end HTML tags as in previous examples, but also uses a
> "negative lookahead" to exclude cases where the right bracket is followed =
by
> a second right bracket (without a left bracket before it). This prevents t=
he
> expression breaking for something like the following:
>
> =09 b) alert()">
>
> But still wouldn't work for (e.g.):
>
> =09

Yeah, that's exactly the issue. For any regex you can come up with, =20
you can always find valid HTML that breaks it.

The real solution (as I mentioned before) is to use a (context-aware) =20
parser. In most cases, this is probably done using some kind of finite =20
state machine.

> One other thought I had, by the way. For HTML to be valid, are attribute
> values required to be escaped? e.g., my first example becomes:
>
> =09
>
> If this is the case, then the "easily broken" regular expression would wor=
k
> so long as the mark-up is "valid" (i.e., attribute values are escaped).

Yeah, I thought of that too - just after I sent my mail. But I'm =20
pretty sure that even with that restriction, it's still possible to =20
come up with HTML that breaks the regex. But I don't have time to give =20
it much thought (or googling) right now.

Dave...