Print Page | Close Window

Regular Expressions

Printed From: Web Wiz Forums
Category: General Discussion
Forum Name: ASP.NET Discussion
Forum Description: Discussion and chat on ASP.NET related topics.
URL: https://forums.webwiz.net/forum_posts.asp?TID=6941
Printed Date: 29 March 2026 at 11:44pm
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com


Topic: Regular Expressions
Posted By: Mart
Subject: Regular Expressions
Date Posted: 03 November 2003 at 3:02am

Basically i want to strip out all javascript. But ive never used regular expressions in asp.net so has anyon egot any good examples or tutorials?

Thanks, Mart.




Replies:
Posted By: Bluefrog
Date Posted: 03 November 2003 at 8:26am

Ah... how timely...

I'm in the middle of writing a VB.NET application and the following function is to strip markup. (The app is for doing regular expressions a bit better than the others I've seen. So far it's NOT  . I'll get it there though.)

I'm not quite done, but I would REALLY like to get a couple beta testers for it if anyone is interested. Actually, I was going to post in a few days for beta testers... It requires the .NET framework.

Hopefully this can at least point you in the right direction.

    Private Function removeMarkup(ByVal theBox) As Boolean
        Dim strMarkUp1 As String
        Dim strMarkUp2 As String
        Dim strMarkUp3 As String
        Dim strMarkUp8 As String

        strMarkUp1 = "(<script[^>]*>[\w|\t|\r|\W]*</script>)"
        strMarkUp2 = "(<style[^>]*>[\w|\t|\r|\W]*</style>)"
        strMarkUp3 = "(<object[^>]*>[\w|\t|\r|\W]*</object>)"

        strMarkUp8 = "(<[^<]+>)"

        Try

             ' need to set the multiline option
             Dim rmvOpts As New RegexOptions()

             rmvOpts = RegexOptions.Singleline
             rmvOpts = rmvOpts Or RegexOptions.Multiline
             rmvOpts = rmvOpts Or RegexOptions.IgnoreCase

             theBox.text = Regex.Replace(theBox.text, strMarkUp1, " " & vbCrLf, rmvOpts)
             theBox.text = Regex.Replace(theBox.text, strMarkUp2, " " & vbCrLf, rmvOpts)
             theBox.text = Regex.Replace(theBox.text, strMarkUp3, " " & vbCrLf, rmvOpts)

             theBox.text = Regex.Replace(theBox.text, strMarkUp8, " ", rmvOpts)

        Catch exp As Exception
             MsgBox("We encountered and error: " & exp.Message, MsgBoxStyle.Critical, Me.Text)
        End Try

    End Function

 



-------------
http://renegademinds.com/" rel="nofollow - Renegade Minds - Guitar Software http://renegademinds.com/Default.aspx?tabid=65" rel="nofollow - Slow Down Music


Posted By: Mart
Date Posted: 03 November 2003 at 9:38am

Thanks alot thats helped me. I wouldnt mind beta testing for you.

Thanks, Mart.



Posted By: MorningZ
Date Posted: 03 November 2003 at 9:49am

Mart, i am going to take a guess that you are going to "AllowHTMLMode" on FreeTextBox for whatever this is for...

keep in mind that you also need to look out for random closing tags like </tr> and </table> in which a member could totally hork the outputted HTML....

i'd suggest not ever ever alllowing HTML entry unless you (1) trust them and (2) they know what the hell they are doing

besides, that RegEx shown above has holes in it..... look at -borg-'s replace code in the forum code for this to see more extensive removal of script kiddies



-------------
Contribute to the working anarchy we fondly call the Internet


Posted By: Diep-Vriezer
Date Posted: 03 November 2003 at 10:05am

I think it is better to just replace the < and > with &lt; and &gt;.

This way ALL the code entered in the textbox will not be visible for the server, and will show up just like in the [ code ] tags at WWF I guess.

Unless you REALLY want the user to put HTML code in it. BTW, the framework has a feature for this, which you can set at the top of the page (in the header) like this:

<%@ validateRequest=true %>



-------------
Gone..


Posted By: Mart
Date Posted: 03 November 2003 at 10:08am

Im keeping AllowHTMLMode False, but this morning i managed to insert a javascript by copy and pasting it into design mode. and its for a forum im writing in asp.net so i have to trust them I will look at the replace functions then.

Thanks, Mart.



Posted By: Diep-Vriezer
Date Posted: 03 November 2003 at 10:09am

R U sure?

EDIT: What a useless question...



-------------
Gone..


Posted By: Mart
Date Posted: 03 November 2003 at 10:09am
<@ AutoEventWireup="false" %> what does that do?


Posted By: Mart
Date Posted: 03 November 2003 at 10:14am
Sorry ignore that post it seems you edited it to validaterequest="false" which i already have it set at.


Posted By: Diep-Vriezer
Date Posted: 03 November 2003 at 12:46pm
You should set it to true to bann any html entry.. BTW, I picked the wrong value  then edited it back to validaterequest.

-------------
Gone..


Posted By: Mart
Date Posted: 03 November 2003 at 1:04pm

No youve obiously misunderstood me, i want them to be able to use html but not insert malicious javascripts.

Mart.



Posted By: Diep-Vriezer
Date Posted: 03 November 2003 at 2:06pm

Alright. BTW you could load the message in an iframe, and avoid the danger of the </tr> commands.



-------------
Gone..


Posted By: Mart
Date Posted: 03 November 2003 at 2:27pm
Thats a pretty good solution actually thanks.


Posted By: Diep-Vriezer
Date Posted: 04 November 2003 at 8:24am
Wow, I answered correct =P

-------------
Gone..


Posted By: Mart
Date Posted: 04 November 2003 at 8:39am

Actually you didnt i found a better solution

If i put all the post in seperate tables like this:

it will prevent vicious </tr>'s wont it?

forum



Posted By: Bluefrog
Date Posted: 04 November 2003 at 9:30am
Originally posted by Mart Mart wrote:

Thanks alot thats helped me. I wouldnt mind beta testing for you.

Thanks, Mart.

Glad it was useful.

I'd really appreciate some feedback if you want to beta test. The current build is at http://deleteme.info/dm.zip - http://deleteme.info/dm.zip . But in all fairness, it isn't finished, although it is (almost) stable. (It doesn't handle bad expressions at the moment - I still have to handle errors for bad reg exs.) Beta at the moment. And it looks ugly too. And it's mother dresses it funny... etc... You need the .NET framework for it to run. Just unzip and run FileManipulator.exe. I'm still working on the networking functionality.

 

 

 



-------------
http://renegademinds.com/" rel="nofollow - Renegade Minds - Guitar Software http://renegademinds.com/Default.aspx?tabid=65" rel="nofollow - Slow Down Music


Posted By: Mart
Date Posted: 04 November 2003 at 9:43am

The page cannot be displayed

The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.

Please try the following:


Cannot find server or DNS Error
Internet Explorer



Posted By: Diep-Vriezer
Date Posted: 04 November 2003 at 12:23pm
Originally posted by Mart Mart wrote:

Actually you didnt i found a better solution

If i put all the post in seperate tables like this:

it will prevent vicious </tr>'s wont it?

No it won't . You'll still be able to use </table> and close the whole table.. Or some other things like </html> or </body> or <a> or whatever. When a user doesn't close the tags, the same thing happens.



-------------
Gone..


Posted By: Mart
Date Posted: 04 November 2003 at 12:54pm

its ok anyway, i can just edit the html parsing function i wrote



Posted By: Diep-Vriezer
Date Posted: 04 November 2003 at 12:55pm
 can I test it =P?

-------------
Gone..


Posted By: Mart
Date Posted: 04 November 2003 at 1:14pm

I dont trust you. You can wait till ive got rid of every security risk i can think of



Posted By: Diep-Vriezer
Date Posted: 04 November 2003 at 1:28pm

Cry He doesn't trust me... bleeeeh.



-------------
Gone..


Posted By: Mart
Date Posted: 04 November 2003 at 1:37pm
Dont take it personally


Posted By: Diep-Vriezer
Date Posted: 04 November 2003 at 2:52pm


-------------
Gone..


Posted By: Bluefrog
Date Posted: 04 November 2003 at 10:33pm

Ooops...

Yeah, I reinstalled that server completely and never took the time to clean up the web server on it. (My ISP blocks port 80.)

Works now with this: http://www.bfsolutions.com/dm.zip - http://www.bfsolutions.com/dm.zip

Sorry about that.

Originally posted by Mart Mart wrote:

The page cannot be displayed

The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.

Please try the following:


Cannot find server or DNS Error
Internet Explorer



-------------
http://renegademinds.com/" rel="nofollow - Renegade Minds - Guitar Software http://renegademinds.com/Default.aspx?tabid=65" rel="nofollow - Slow Down Music


Posted By: Mart
Date Posted: 05 November 2003 at 9:45am
What does it actually do!


Posted By: Diep-Vriezer
Date Posted: 05 November 2003 at 10:49am
What's the use of filling the screen (twice) with an error page??  Am I missing something?

-------------
Gone..


Posted By: Mart
Date Posted: 05 November 2003 at 2:31pm

Is it meant for searching files?



Posted By: Bluefrog
Date Posted: 05 November 2003 at 4:08pm

It's for searching files and returning result sets. Ideally, I'd like to make it usable for 'humans', because regular expressions are not exactly useful for most people. Hence the minor presets available... 'word', 'space', etc. The interface is horrid, but I'm still learning VB.NET, so I'm trying to get the basic functionality first. The primary use will be for teachers who teach languages to non-native speakers, so that they can quickly get examples of grammar structures.

Later, I'll have it store the result sets in a database so that they can be reused.  



-------------
http://renegademinds.com/" rel="nofollow - Renegade Minds - Guitar Software http://renegademinds.com/Default.aspx?tabid=65" rel="nofollow - Slow Down Music


Posted By: Bluefrog
Date Posted: 06 November 2003 at 8:47am

http://deleteme.info:64646/dm.zip - http://deleteme.info:64646/dm.zip

That should work... I really need to get another server...



-------------
http://renegademinds.com/" rel="nofollow - Renegade Minds - Guitar Software http://renegademinds.com/Default.aspx?tabid=65" rel="nofollow - Slow Down Music



Print Page | Close Window

Forum Software by Web Wiz Forums® version 12.08 - https://www.webwizforums.com
Copyright ©2001-2026 Web Wiz Ltd. - https://www.webwiz.net