纯文字评论提交的时候要过滤那些内容?

[Chronicle]

想用文本框做个简单的评论提交页面,要求过滤js脚本网页标签等等,但换行空格保留,总而言之最后的结果就像贴吧那样,不含被浏览器执行的内容.

请问一般要怎样书写代码,能否给个例子参考.

或者说有这方面写好的控件,我找了一下貌似功能都太强大.

[Chronicle]

sContent=Server.HtmlEncoder(Trim(Request.Form("content")))
sContent=Replace(SContent,vbCrLf,"<br/>")
sContent=Replace(SContent,Chr(9),"   ")

ls几位好像都没有注意到换行,这样如何?

[Dogfish]

至少把html那些有害的代码去掉。如iframe等等。

[lzp4881]

替换<>为<>就行了

[g497772921]

过滤函数
Function IN_Replace(N_urlString)
N_urlString = Replace(N_urlString,"'","‘")
N_urlString = Replace(N_urlString, ";","；")
N_urlString = Replace(N_urlString, ">", ">")
N_urlString = Replace(N_urlString, "<", "<")
N_urlString = Replace(N_urlString, "<", "<")
N_urlString = Replace(N_urlString, "href", "")
N_urlString = Replace(N_urlString, "script", " ")
N_urlString = Replace(N_urlString, "iframe", " ")
N_urlString = Replace(N_urlString, "src", "")
N_urlString = Replace(N_urlString, "url", "")
N_urlString = Replace(N_urlString, "(", "（")
N_urlString = Replace(N_urlString, ")", "）")
N_urlString = Replace(N_urlString, "[", "『")
N_urlString = Replace(N_urlString, "]", "』")
IN_Replace = N_urlString
End Function

[lbcleo]

<script type="text/javascript">
<!--

var str = '<ok>,-';

// 用Hash存储进行正则替换
String.prototype.multiReplace = function(hash){
var str = this, key;
for(key in hash){
if(Object.prototype.hasOwnProperty.call(hash, key)){
str = str.replace(new RegExp( key, 'g'), hash[key]);
}
}
return str;
}
str = str.multiReplace({
'&(?!#?\\w+;)' : '&' ,
'"([^"]*)"' : '“$1”' ,
'<' : '<' ,
'>' : '>' ,
'…' : '…',
'“' : '“' ,
'”' : '”' ,
'‘' : '‘' ,
'’' : '’' ,
'—' : '—' ,
'–' : '–'
});
alert(str);

//-->
</script>

[gaozhen1990]

一般是替换 <>

[caizhuguanguan]

3 楼不错

[KK3K2005]

强制htmlcode输出

[叫我梁大侠]

可以选择简单的过滤全部HTNL代码：
Dim re
Set re=new RegExp
re.IgnoreCase =True
re.Global=True
re.Pattern="<(.[^>]*)>"
CleanHTML=re.Replace(str,"")
set re=Nothing