Find Javascript Code inside String

Question

Greetings friends,

I am developing a web application that will allow the customer to enter a personalized message, which will then be converted to HTML. Well, the problem is that I can not allow the insertion of Javascript code. So I need a method that filters the text, searching for and remove it. I think the regular expressions to solve my problem, but I'm having difficulty building. Some of his friends could help me, or has already developed something for this.

Thank you.

Answer 1

You don't need to worry at what the customer enters and is saved into the database. You need to worry what you are showing in the View. All you need is to html encode the message before displaying it:

<%= Html.Encode(Model.TheMessage) %>

or using the new ASP.NET 4.0 code nugget:

<%: Model.TheMessage %>