Being weak on regular expressions, I've been working with them to improve. One concept I've been trying to do is to remove all HTML elements except for a list of allowed ones.
I've managed to do the reverse -- remove a specified list of elements:
<\/?(strong|em|a)[^>]*>
However I want the opposite, and remove every element but.
Do NOT try parsing with regular expressions
Instead use a real parser
/<(.|\n)*?>/g
matches all HTML tags pairs including attributes in the tags
Exclude tags strong and em
(?!strong|em)
matches all HTML tags pairs but strong and em
<((?!strong|em).|\n)*?>
Don't use regex for parsing [X]HTML.
Doubly especially definitely NEVER use regex for parsing [X]HTML as a security measure.
An HTML parser (or tidier followed by an XML parser) is the only workable approach for whitelisting.
/<(.|\n)*?>/g matches all HTML tags pairs including attributes in the tags
No.
<a href=">" onmouseover="attackCode()">
and a thousand other possibilities, both valid and malformed-but-the-browser-will-still-understand-it.