避免HTML和Scripts标签呈现

Question

I've been working in a Chat Box, I use Node.js + socket.io for client-server communication so I can't execute PHP code(I've read that is possible but It's not recommended and difficult to achieve). Everything works fine except when users send messages with HTML or Scripts tags.

I've tried to remove those tags with a function that I found in here . It works fine, but only for HTML tags, then I thought: Well, I can remove Script tags first using regular expressions. Something like this

.replace(/<script.*>.*<\\/script>/ims, " ")

and then remove the HTML tags, but I'm not sure if this method is hacks proof, and that's a lot of processes for each message sent.

Is there any form of appending text $("#div").append(message); without rendering HTML/JavaScript code ? --- Print the text just the way it is, like in twitch.tv , in there, if you send a message with HTML/JS/PHP code, the message is printed just like the way you type it.

or, is there any other way to remove tags ?

Thanks for your time.

Answer 1

只需在div后面附加消息设置为文本即可。

$("#div").append( $("<div>").text(message) );