blocks|key|1384821|text|这应该可以做到：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1384822|echo+preg_replace('/<script\b[%5E>]*>(.*?)<\/script>/is',+"",+$var);|code-block|syntax|javascript|1384823|/s是这样的点。也匹配换行符。|1384824|这只是一个警告，您不应该使用这种类型的regexp来清理网站的用户输入。有太多的方法可以绕过它。对于清理，使用类似于http://htmlpurifier.org/库的东西|offset|length|1384825|entityMap|0|LINK|mutability|MUTABLE|url|http://htmlpurifier.org/^0|0|0|0|1M|O|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|W|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|X|8|@]|9|@$K|Y|L|Z|1|10]]|A|$]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]]]

<p>this should do it:</p>

<pre><code>echo preg_replace('/&lt;script\b[^&gt;]*&gt;(.*?)&lt;\/script&gt;/is', "", $var);
</code></pre>

<p>/s is so that the dot . matches newlines too.</p>

<p>Just a warning, you should not use this type of regexp to sanitize user input for a website. There is just too many ways to get around it. For sanitizing use something like the <a href="http://htmlpurifier.org/" rel="noreferrer">http://htmlpurifier.org/</a> library</p>


blocks|key|1384777|text|这可能会超出您的期望，但根据您的情况，您可能希望查看strip_tags。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1384778|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/strip%2520tags^0|Q|A|Q|A|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

<p>This might do more than you want, but depending on your situation you might want to look at <a href="http://php.net/strip%20tags" rel="nofollow noreferrer"><code>strip_tags</code></a>.</p>


blocks|key|1169797|text|我有个想法|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1169798|while+(true)+{
++if+($beginning+=+strpos($var,"<script"))+{
++++$stringLength+=+(strpos($var,"</script>")+%2B+strlen("</script>"))+-+$beginning;
++++substr_replace($var,+"",+$beginning,+$stringLength);
++}+else+{
++++break
++}
}|code-block|syntax|javascript|1169799|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

<p>Here's an idea</p>

<pre><code>while (true) {
  if ($beginning = strpos($var,"&lt;script")) {
    $stringLength = (strpos($var,"&lt;/script&gt;") + strlen("&lt;/script&gt;")) - $beginning;
    substr_replace($var, "", $beginning, $stringLength);
  } else {
    break
  }
}
</code></pre>


blocks|key|1384878|text|在本例中，您可以将字符串视为换行符分隔的字符串列表，并删除包含脚本标记的行(第一行和倒数第二行)，甚至不需要正则表达式。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1384879|但是，如果您要做的是防止XSS，那么只删除脚本标记可能是不够的。|offset|length|1384880|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Cross-site_scripting^0|0|C|3|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

<p>In your case you could regard the string as a list of newline delimited strings and remove the lines containing the script tags(first &amp; second to last) and you wouldn't even need regular expressions.</p>

<p>Though if what you are trying to do is preventing <a href="http://en.wikipedia.org/wiki/Cross-site_scripting" rel="nofollow noreferrer">XSS</a> it might not be sufficient to only remove script tags.</p>


blocks|key|1169828|text|function+clean_jscode($script_str)+{
++++$script_str+=+htmlspecialchars_decode($script_str);
++++$search_arr+=+array('<script',+'</script>');
++++$script_str+=+str_ireplace($search_arr,+$search_arr,+$script_str);
++++$split_arr+=+explode('<script',+$script_str);
++++$remove_jscode_arr+=+array();
++++foreach($split_arr+as+$key+=>+$val)+{
++++++++$newarr+=+explode('</script>',+$split_arr[$key]);
++++++++$remove_jscode_arr[]+=+($key+==+0)+?+$newarr[0]+:+$newarr[1];
++++}
++++return+implode('',+$remove_jscode_arr);
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|1169829|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>function clean_jscode($script_str) {
    $script_str = htmlspecialchars_decode($script_str);
    $search_arr = array('&lt;script', '&lt;/script&gt;');
    $script_str = str_ireplace($search_arr, $search_arr, $script_str);
    $split_arr = explode('&lt;script', $script_str);
    $remove_jscode_arr = array();
    foreach($split_arr as $key =&gt; $val) {
        $newarr = explode('&lt;/script&gt;', $split_arr[$key]);
        $remove_jscode_arr[] = ($key == 0) ? $newarr[0] : $newarr[1];
    }
    return implode('', $remove_jscode_arr);
}
</code></pre>


blocks|key|1169848|text|这对我来说非常有用。试试这段代码。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1169849|while(($pos+=+stripos($content,"<script"))!==false){
++++$end_pos+=+stripos($content,"</script>");
++++$start+=+substr($content,+0,+$pos);
++++$end+=+substr($content,+$end_pos%2Bstrlen("</script>"));
++++$content+=+$start.$end;
}
$text+=+strip_tags($content);|code-block|syntax|javascript|1169850|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

<p>this was very usefull for me. try this code.</p>

<pre><code>while(($pos = stripos($content,"&lt;script"))!==false){
    $end_pos = stripos($content,"&lt;/script&gt;");
    $start = substr($content, 0, $pos);
    $end = substr($content, $end_pos+strlen("&lt;/script&gt;"));
    $content = $start.$end;
}
$text = strip_tags($content);
</code></pre>


blocks|key|1385029|text|你可以在下面的函数的帮助下从HTML字符串中删除任何JavaScript代码|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1385030|你可以在这里阅读更多信息：https://mradeveloper.com/blog/remove-javascript-from-html-with-php|offset|length|1385031|function+sanitizeInput($inputP)
{
++++$spaceDelimiter+=+"#BLANKSPACE#";
++++$newLineDelimiter+=+"#NEWLNE#";
++++++++++++++++++++++++++++++++
++++$inputArray+=+[];
++++$minifiedSanitized+=+'';
++++$unMinifiedSanitized+=+'';
++++$sanitizedInput+=+[];
++++$returnData+=+[];
++++$returnType+=+"string";

++++if($inputP+===+null)+return+null;
++++if($inputP+===+false)+return+false;
++++if(is_array($inputP)+&&+sizeof($inputP)+<=+0)+return+[];

++++if(is_array($inputP))
++++{
++++++++$inputArray+=+$inputP;
++++++++$returnType+=+"array";
++++}
++++else
++++{
++++++++$inputArray[]+=+$inputP;
++++++++$returnType+=+"string";
++++}

++++foreach($inputArray+as+$input)
++++{
++++++++$minified+=+str_replace("+",$spaceDelimiter,$input);
++++++++$minified+=+str_replace("\n",$newLineDelimiter,$minified);

++++++++//removing+<script>+tags
++++++++$minifiedSanitized+=+preg_replace("/[<][%5E<]*script.*[>].*[<].*[\/].*script*[>]/i","",$minified);

++++++++$unMinifiedSanitized+=+str_replace($spaceDelimiter,"+",$minifiedSanitized);
++++++++$unMinifiedSanitized+=+str_replace($newLineDelimiter,"\n",$unMinifiedSanitized);

++++++++//removing+inline+js+events
++++++++$unMinifiedSanitized+=+preg_replace("/([+]on[a-zA-Z0-9_-]{1,}=\".*\")%7C([+]on[a-zA-Z0-9_-]{1,}='.*')%7C([+]on[a-zA-Z0-9_-]{1,}=.*[.].*)/","",$unMinifiedSanitized);

++++++++//removing+inline+js
++++++++$unMinifiedSanitized+=+preg_replace("/([+]href.*=\".*javascript:.*\")%7C([+]href.*='.*javascript:.*')%7C([+]href.*=.*javascript:.*)/i","",$unMinifiedSanitized);

++++++++++++++++++++++++++++++++++++
++++++++$sanitizedInput[]+=+$unMinifiedSanitized;
++++}

++++if($returnType+==+"string"+&&+sizeof($sanitizedInput)+>+0)
++++{
++++++++$returnData+=+$sanitizedInput[0];
++++}
++++else
++++{
++++++++$returnData+=+$sanitizedInput;
++++}
++++++++++++++++++++++++++++++++
++++return+$returnData;
}|code-block|syntax|javascript|1385032|entityMap|0|LINK|mutability|MUTABLE|url|https://mradeveloper.com/blog/remove-javascript-from-html-with-php^0|0|D|1U|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@$D|U|E|V|1|W]]|A|$]]|$1|F|3|G|5|H|7|X|8|@]|9|@]|A|$I|J]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

<p>You can remove any JavaScript code from HTML string with the help of following PHP function</p>
<p>You can read more about it here:
<a href="https://mradeveloper.com/blog/remove-javascript-from-html-with-php" rel="nofollow noreferrer">https://mradeveloper.com/blog/remove-javascript-from-html-with-php</a></p>
<pre><code>function sanitizeInput($inputP)
{
    $spaceDelimiter = &quot;#BLANKSPACE#&quot;;
    $newLineDelimiter = &quot;#NEWLNE#&quot;;
                                
    $inputArray = [];
    $minifiedSanitized = '';
    $unMinifiedSanitized = '';
    $sanitizedInput = [];
    $returnData = [];
    $returnType = &quot;string&quot;;

    if($inputP === null) return null;
    if($inputP === false) return false;
    if(is_array($inputP) &amp;&amp; sizeof($inputP) &lt;= 0) return [];

    if(is_array($inputP))
    {
        $inputArray = $inputP;
        $returnType = &quot;array&quot;;
    }
    else
    {
        $inputArray[] = $inputP;
        $returnType = &quot;string&quot;;
    }

    foreach($inputArray as $input)
    {
        $minified = str_replace(&quot; &quot;,$spaceDelimiter,$input);
        $minified = str_replace(&quot;\n&quot;,$newLineDelimiter,$minified);

        //removing &lt;script&gt; tags
        $minifiedSanitized = preg_replace(&quot;/[&lt;][^&lt;]*script.*[&gt;].*[&lt;].*[\/].*script*[&gt;]/i&quot;,&quot;&quot;,$minified);

        $unMinifiedSanitized = str_replace($spaceDelimiter,&quot; &quot;,$minifiedSanitized);
        $unMinifiedSanitized = str_replace($newLineDelimiter,&quot;\n&quot;,$unMinifiedSanitized);

        //removing inline js events
        $unMinifiedSanitized = preg_replace(&quot;/([ ]on[a-zA-Z0-9_-]{1,}=\&quot;.*\&quot;)|([ ]on[a-zA-Z0-9_-]{1,}='.*')|([ ]on[a-zA-Z0-9_-]{1,}=.*[.].*)/&quot;,&quot;&quot;,$unMinifiedSanitized);

        //removing inline js
        $unMinifiedSanitized = preg_replace(&quot;/([ ]href.*=\&quot;.*javascript:.*\&quot;)|([ ]href.*='.*javascript:.*')|([ ]href.*=.*javascript:.*)/i&quot;,&quot;&quot;,$unMinifiedSanitized);

                                    
        $sanitizedInput[] = $unMinifiedSanitized;
    }

    if($returnType == &quot;string&quot; &amp;&amp; sizeof($sanitizedInput) &gt; 0)
    {
        $returnData = $sanitizedInput[0];
    }
    else
    {
        $returnData = $sanitizedInput;
    }
                                
    return $returnData;
}
           
</code></pre>


blocks|key|1384914|text|我使用的是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1384915|function+clear_text($s)+{
++++$do+=+true;
++++while+($do)+{
++++++++$start+=+stripos($s,'<script');
++++++++$stop+=+stripos($s,'</script>');
++++++++if+((is_numeric($start))&&(is_numeric($stop)))+{
++++++++++++$s+=+substr($s,0,$start).substr($s,($stop%2Bstrlen('</script>')));
++++++++}+else+{
++++++++++++$do+=+false;
++++++++}
++++}
++++return+trim($s);
}|code-block|syntax|javascript|1384916|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

<p>I use this:</p>

<pre><code>function clear_text($s) {
    $do = true;
    while ($do) {
        $start = stripos($s,'&lt;script');
        $stop = stripos($s,'&lt;/script&gt;');
        if ((is_numeric($start))&amp;&amp;(is_numeric($stop))) {
            $s = substr($s,0,$start).substr($s,($stop+strlen('&lt;/script&gt;')));
        } else {
            $do = false;
        }
    }
    return trim($s);
}
</code></pre>


<p>I am trying to remove JavaScript from the HTML. </p>

<p>I can't get the regular expression to work with PHP; it's giving me an null array.  Why?</p>

<pre><code>&lt;?php
$var = '
&lt;script type="text/javascript"&gt; 
function selectCode(a) 
{ 
   var e = a.parentNode.parentNode.getElementsByTagName(PRE)[0]; 
   if (window.getSelection) 
   { 
      var s = window.getSelection(); 
       if (s.setBaseAndExtent) 
      { 
         s.setBaseAndExtent(e, 0, e, e.innerText.length - 1); 
      } 
      else 
      { 
         var r = document.createRange(); 
         r.selectNodeContents(e); 
         s.removeAllRanges(); 
         s.addRange(r); 
      } 
   } 
   else if (document.getSelection) 
   { 
      var s = document.getSelection(); 
      var r = document.createRange(); 
      r.selectNodeContents(e); 
      s.removeAllRanges(); 
      s.addRange(r); 
   } 
   else if (document.selection) 
   { 
      var r = document.body.createTextRange(); 
      r.moveToElementText(e); 
      r.select(); 
   } 
} 
&lt;/script&gt;
';

   function remove_javascript($java){
   echo preg_replace('/&lt;script\b[^&gt;]*&gt;(.*?)&lt;\/script&gt;/i', "", $java);

   }    
?&gt;
</code></pre>


PHP Remove JavaScript

我正在尝试从超文本标记语言中删除JavaScript。我不能让正则表达式在PHP中工作；它给了我一个空数组。为什么？<?php$var = '<script type="text/javascript"> function selectCode(a) {    var e = a.parentNode.parentNode.getElementsByTagName(PRE)[0];    if (

问PHP删除JavaScript
EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP删除JavaScriptEN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHP删除JavaScript
EN