asp strip_tags()

[bigggnick]

Hey all,I was helping a friend with a site that i found some xss in. I know some php, engough to know about strip_tags(). I want to help him get rid of the xss, but im not sure how to do it in asp. Any help? Much appreciated.Thanks

[Yahweh]

You need to define your own strip_tags() function. You can strip tags easily with regex.

Public Function strip_tags(someString)	Dim myRegex	Set myRegex = new regexp	myRegex.global = True	myRegex.IgnoreCase = true	myRegex.Multiline = true	myRegex.Pattern = "<[^> ]+[\s\S]*?>"		 'matches any valid tag		strip_tags = myRegex.Replace(someString, "")End Function

You might need a more powerful regex, because that won't catch malformed tags. However, it should be good enough to get you started.

[Yahweh]

It just occurred to me, another way to get rid of cross site scripting is using something like this:

Function sanitize_input(someString)	santize_input = Server.HTMLEncode(someString)End Function

That converts >, <, " (double quotes), and a few other characters to their harmless ascii equivalents, >, &lt, &quote;.

[bigggnick]

thanks, sorry for my lateness but i really appreciate it.