I need to solve a problem with javascript injection in a form textarea and fields
script type='text/javascript'
window.location='http:site.com';
/script
or
a href='javascript:...'
or
form action...
or
input name...
but i preserve some html tags for example a, b, ul... is this possible?
Try using HTML Purifier to specify just what types of HTML you want to allow to protect yourself from such XSS attacks.
If you're worried about XSS, you need to process the input on the server side to make sure there's no JavaScript in it. Hopefully this Perl example will help (apologies for the regex, it's not my strong suit)
use strict;
my $str = <<HTML;
<body>
<div>
sfdasfasdfs
<script type="text/javascript">
window.location.href = "http://badsite.com";
</script>
sadfssdfssdf
</div>
</body>
HTML
$str =~ s/<script.*?>[\s\w\d\W]*<\/script>//g;
print "$str\n";