How to disable inline javascript in html?

Question

I have html entered by user that is put in an iframe. The purpose is to suppress all inline javascript in the html. Have thought about Regexp to remove all scripts, but it caught only <script> ... </script>, but no <txt onload='..javascript...

This is the regex: /<\s*script[^>]*>[^<]*<\s*\/\s*script\s*>/gi

How can I block all js in the entered html?

The functionality you are looking for is called sanitizing. Check this question and answer stackoverflow.com/questions/23952684/… — Nikita
– Nikita, Commented Mar 28, 2020 at 12:30

Guerric P · Accepted Answer · 2020-03-28 10:32:52Z

1

Just set sandbox="" in the iframe tag and that won't allow scripts to execute.

To figure it out you can add the sandbox attribute in this demo https://www.w3schools.com/tags/tryit.asp?filename=tryhtml_iframe, then run it and open your console.

Chrome displays this message:

Blocked script execution in '' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

answered Mar 28, 2020 at 10:32

Guerric P

32k6 gold badges61 silver badges109 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to disable inline javascript in html?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related