HTMLPurify - Disable Javascript

Question

I use HTMLPurify for disabling JavasSript in a textarea.

My problem is:

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier();
$va = $purifier->purify($va);

This removes script tags, but does not remove [a href='javascript:...']link[/a]

What should I do to remove the bad links and retain good links?

Answer 1

Use regular expressions to scan the textareas content for invalid / unwanted tags.

Answer 2

Try setting the AllowedSchemes whitelist.

Answer 3

The live demo is indeed filtering both href="javascript:... and onclick. You can see the demo here.

Maybe you are using an older version?