如何在 html 中禁用内联 javascript？

Question

I have html entered by user that is put in an iframe. The purpose is to suppress all inline javascript in the html. Have thought about Regexp to remove all scripts, but it caught only <script> ... </script> , but no <txt onload='..javascript...

This is the regex: /<\\s*script[^>]*>[^<]*<\\s*\\/\\s*script\\s*>/gi

How can I block all js in the entered html?

Answer 1

Just set sandbox="" in the iframe tag and that won't allow scripts to execute.

To figure it out you can add the sandbox attribute in this demo https://www.w3schools.com/tags/tryit.asp?filename=tryhtml_iframe , then run it and open your console.

Chrome displays this message:

Blocked script execution in '' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.