Re: Stripping HTML

Matt Groves writes:

> Thanks for your replies.  Having played around a bit,
> 
>         $inbound =~ s/<.+?>//g  ;
> 
> Works great.  Can anyone see any problems with this ?

If somebody enters something like:

  <script src="http://example.com/nasty_redirect.js"

your pattern won't match anything (because there isn't a ">" in there
anywhere), so the original will be left intact.

After you've inserted it into your webpage -- say inside a <blockquote>
you may end up with something like:

  <blockquote><script src="http://example.com/nasty_redirect.js" </blockquote>

The entered <script> tag has made it into your document, continuing
through to the next ">" that you put there.   (Admittedly it's got the
decidedly nonstandard "</blockquote" attribute, but nonstandard
attributes are supposed to be ignored by browsers.)

Smylers