Re: Do not support HTML in textarea - on server-side by Anthony
Anthony
Wed Oct 24 07:52:43 PDT 2007
"Gabriella" <frohlinger@yahoo.com> wrote in message
news:1193223722.942106.287890@q3g2000prf.googlegroups.com...
> Hi,
> I have a textarea and I would like to prevent users from inserting
> HTML tags. Only plain text is supported.
> Which server-side vbscript regular expression is best for this?
> Thanks, Gabi
>
Do you allow them to enter an ampersand (&)?
Personally I prefer to protect the outgoing mechanism. Never include user
entered data in generated HTML without using Server.HTMLEncode. That way if
the user enters "<script>code to delete all your files</script>" then thats
what they end up seeing.
--
Anthony Jones - MVP ASP/ASP.NET