Although this type of question may have been asked multiple times before, I am confident that this one is unique. On the server side, I have an Input TextArea control and I am attempting to eliminate all inline scripts or HTML injections. I have successfully removed script tags by using the following code-
$(document).ready(function () {
$('#btnHTML').click(function () {
var textarea = document.getElementById("txtar1");
var stringOfHtml = textarea.value;
var wrappedString = '<div>' + stringOfHtml + '</div>';
var noScript = wrappedString.replace(/script/g, "THISISNOTASCRIPTREALLY");
var html = $(noScript);
html.find('THISISNOTASCRIPTREALLY').remove();
var tmp = document.createElement("DIV");
tmp.id = "tmp";
tmp.innerHTML = html.html().replace(/THISISNOTASCRIPTREALLY/g, 'script');
document.body.appendChild(tmp);
alert(html.html().replace(/THISISNOTASCRIPTREALLY/g, 'script'));
});<textarea id="txtar1" style="width:200px;height:100px"></textarea><br/>
<input type="button" id="btnHTML" value="Remove HTML" />However, my objective remains unaccomplished as I am seeking to prevent or eliminate all forms of inline script injection. Some examples include-
<div>
<table border="2">
<tr>
<td><b>ABCD</b></td>
<td onclick="javascript:alert('Hello')">
EFGH</td>
</tr>
</table>
</div>
<div>
<table border="2">
<tr>
<td><b>Test</b></td>
<td alert('Hello')>
Success</td>
</tr>
</table>
</div>
<META HTTP-EQUIV="refresh" CONTENT="1;url=http://www.test.com">
<BR SIZE="&{alert('Injected')}">
<DIV STYLE="background-image: url(javascript:alert('Injected'))">Any assistance or recommendations would be greatly appreciated.