javascript过滤危险脚本方法

运行可以看到效果:

<textarea id="bug" cols="80" rows="5">
<a onclick="test();
test1()" onblur=
"test3()">test</a>
</textarea>
<button id="kick">抓虫2</button>
<script>
function kickBug(str) {
return str.replace(/<[a-z][^>]*s*on[a-z]+s*=[^>]+/ig,function($0,$1){
return $0.replace(/s*on[a-z]+s*=s*("[^"]+"|'[^']+'|[^s]+)s*/ig,"");
});
}
if(!/msie/i.test(navigator.userAgent)){
HTMLElement.prototype.__defineGetter__("innerText",function(){
return this.textContent;
});
HTMLElement.prototype.__defineSetter__("innerText",function(text){
this.textContent = text;
});
}
document.getElementById("kick").onclick = function() {
var bug = document.getElementById("bug");
bug.innerText = kickBug(bug.innerText);
}
</script>

运行可以看到效果:

<textarea id="bug" cols="80" rows="5">
<a onclick="test();" href="
jAvascript:alert('a')" href="jAvascript:"
href="vbscript:alert()"
>test</a>
</textarea>
<button id="kick">抓虫3</button>
<script>
function kickBug(str) {
return str.replace(/<[a-z][^>]*s*(href|src)s*=[^>]+/ig,function($0,$1){
$0 = $0.replace(/&#(6[5-9]|[78][0-9]|9[0789]|1[01][0-9]|12[012]);?/g,function($0,$1){return String.fromCharCode($1);});
return $0.replace(/s*(href|src)s*=s*("s*(javascript|vbscript):[^"]+"|'s*(javascript|vbscript):[^']+'|(javascript|vbscript):[^s]+)/ig,"");
});
}
if(!/msie/i.test(navigator.userAgent)){
HTMLElement.prototype.__defineGetter__("innerText",function(){
return this.textContent;
});
HTMLElement.prototype.__defineSetter__("innerText",function(text){
this.textContent = text;
});
}
document.getElementById("kick").onclick = function() {
var bug = document.getElementById("bug");
bug.innerText = kickBug(bug.innerText);
}