在注释系统中禁用代码

Question

I have created a comment system where people comment on a topic. The comment is stored in a SQL database. Now, to avoid malicious links, or JS/HTML/PHP code to be inserted into the comment which could be executed.. How do I prevent this? Suppose the comment is a JS code.. Like

<script> document.DoSomething()</script>

How would I prevent this? Thanks.

Answer 1

You need to scrub and/or encode user input that you're displaying.

Here is an example of how server emitting contents encodes it (this is Microsoft .NET)

<script><%=Html.Encode(serverSide.DoSomething())%></script>

Scrubbing is a popular topic. Most times it's better to use something that is ready, as the variations of such attacks are so many, that starting from scrach is usually not going to give you the coverage you'd get from existing libs. Look at this one for example: https://code.google.com/p/google-caja/

Answer 2

Match the comment with a regex like so:

comment.match(/<script>.+</script>/)

If there is a match, then don't allow it.