Disable html/javascripts commands in text fields

Question

How do I prevent input in texts fields from containing HTML and JavaScript code?

Example: I have an input text field. If the user enters javascript instructions, then they get executed.

How can I modify

<script>alert('aces')</script> 

so that it will show up as normal text in my field and not as a alert when i try to list it?

Answer 1

Have you looked into libraries like underscore.js (used by Backbone.js)?

It comes with escape functions that prevents user entered javascript to run. http://underscorejs.org/#escape and http://underscorejs.org/#unescape

so you would write:

alert(_.escape(USERINPUT));

this becomes even more important when you add user input to your DOM, for security reasons you need to escape inputs (or allow only a selection of harmless tags like < strong >).