note 89453 added to function.strip-tags

Thanks for posting your scripts, I have been able figure out some intersting things: I still have concerns about improperly formatted javascript being add to tags. The regex tools are helpful.. but may not be able to be used how I was expecting. There are some concerns about the limit of 15 instences of recursion before memory alocation run out. Here is the code that I created to leave tags intact but strip scripting from only inside the tags... function strip_javascript($filter){ // realign javascript href to onclick $filter = preg_replace("/href=(['\"]).*?javascript:(.*)? \\1/i", "onclick=' $2 '", $filter); //remove javascript from tags while( preg_match("/<(.*)?javascript.*?\(.*?((?>[^()]+) |(?R)).*?\)?\)(.*)?>/i", $filter)) $filter = preg_replace("/<(.*)?javascript.*?\(.*?((?> [^()]+)|(?R)).*?\)?\)(.*)?>/i", "<$1$3$4$5>", $filter); // dump expressions from contibuted content if(0) $filter = preg_replace("/:expression\(.*?((?>[^ (.*?)]+)|(?R)).*?\)\)/i", "", $filter); while( preg_match("/<(.*)?:expr.*?\(.*?((?>[^()]+)|(? R)).*?\)?\)(.*)?>/i", $filter)) $filter = preg_replace("/<(.*)?:expr.*?\(.*?((?>[^()] +)|(?R)).*?\)?\)(.*)?>/i", "<$1$3$4$5>", $filter); // remove all on* events while( preg_match("/<(.*)?\s?on.+?=?\s?.+?(['\"]).*?\\2 \s?(.*)?>/i", $filter) ) $filter = preg_replace("/<(.*)?\s?on.+?=?\s?.+? (['\"]).*?\\2\s?(.*)?>/i", "<$1$3>", $filter); return $filter; } As you can see this does not clean up correctly... it does however remove dangerous stuff... <a href=javascript: { {({}{}()())}alert('xss') ) ) }> <div onload..;,;..'alert(\"xss_attack\");'> <a href='javascript:{ alert(\"xss_attack\"); otherxss();}' onclick= 'alert(\"xss_attack\");' onhover='alert (\"xss_attack\");' onmouseout=alert(\"xss_attack\") class='thisclass'> link</a> style='width:expression(alert(\"xss_attack\"));' This can be completed before using strip_tags(). ---- Server IP: 208.69.120.35 Probable Submitter: 76.106.50.141 ---- Manual Page -- http://www.php.net/manual/en/function.strip-tags.php Edit -- https://master.php.net/note/edit/89453 Del: integrated -- https://master.php.net/note/delete/89453/integrated Del: useless -- https://master.php.net/note/delete/89453/useless Del: bad code -- https://master.php.net/note/delete/89453/bad+code Del: spam -- https://master.php.net/note/delete/89453/spam Del: non-english -- https://master.php.net/note/delete/89453/non-english Del: in docs -- https://master.php.net/note/delete/89453/in+docs Del: other reasons-- https://master.php.net/note/delete/89453 Reject -- https://master.php.net/note/reject/89453 Search -- https://master.php.net/manage/user-notes.php