I'd like to show a text with HTML execution (formated) in the browser so it will be easy to read BUT without any JavaScript execution. It's a large text and it's very hard to read between HTML tags. So, execute HTML but not JavaScript.
What I did: I loaded this text in an <iframe>
so I can have full control and I tried to show the text like this:
<script>
throw new Error('This is just to abort javascript');
</script>
<?php echo $text ?>
<script>
throw new Error('This is just to abort javascript');
</script>
The console does show an error but even so, if I have
$text = '<script>alert(1)</script>';
this script gets executed anyway.
Another XSS example that I'd like to avoid.
$text = '<a href="#" onmouseover="alert(1)">this is a fake url</a>';
Basically, abort any JavaScript execution from the page.
Thanks in advance!
$text
, or do you want them to be displayed as text in the iframe without executing?<a href="javascript:alert(1);void(0);">I'm totally legit, click me.</a>
<script>
tags. As @samlev say, there ishref="javascript:
and also we can have events (onmouse...
,onload
and many others). So, "parse the text and remove scripts" is not a solution. I need to force the browser to abort/stop any scripts. I got my solution: cannot be done :) Thank you all!