Clever Geek Handbook

How to make a C # / BlackList whitelist

I want to validate the HTML tags that the user is using in a rich html editor that I have. I'm not sure how to do this in C #.

Should I use Regex and what HTML tags should I blacklist / whitelist?

+2


source to share


3 answers


Simple whitelist:

string input = "<span><b>99</b> < <i>100</i></span> <!-- 99 < 100 -->";

// escape & < and >
input = input.Replace("&", "&amp;").Replace(">", "&gt;").Replace("<", "&lt;");

// unescape whitelisted tags
string output = input.Replace("&lt;b&gt;", "<b>").Replace("&lt;/b&gt;", "</b>")
                     .Replace("&lt;i&gt;", "<i>").Replace("&lt;/i&gt;", "</i>");

Output:



&lt;span&gt;<b>99</b> &lt; <i>100</i>&lt;/span&gt; &lt;!-- 99 &lt; 100 --&gt;

Displayed output:

<span> 99 <<i> 100 </ span> gt; <-99 <100 →

0


source


Assuming the tags are entered as a single line, like here on StackOverflow, you need to split the line into separate tags first:

string[] tags = "c# html  lolcat  ".Split(
    new char[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);

Whitelisting / blacklisting can be represented by HashSet<T>

storing tags:



HashSet<string> blacklist = new HashSet<string>(
    StringComparer.CurrentCultureIgnoreCase) { "lolcat", "lolrus" };

Then you will need to check if the list contains one of tags

:

bool invalid = tags.Any(blacklist.Contains);
0


source


You can try the Html Agility Pack . I haven't tried skipping the tags, but he could certainly find the tags.

0


source






More articles:


All Articles