js过滤script标签

function sanitizeInput(input) {
    // 使用正则表达式移除<script>标签及其内容
    const sanitized = input.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
    return sanitized;
}

// 示例用法
const userInput = '<p>Hello</p><script>alert("XSS");</script>';
const safeInput = sanitizeInput(userInput);
console.log(safeInput); // 输出: <p>Hello</p>

function encodeHTML(str) {
    return str.replace(/&/g, '&')
              .replace(/</g, '&lt;')
              .replace(/>/g, '&gt;')
              .replace(/"/g, '&quot;')
              .replace(/'/g, '&#39;');
}

// 示例用法
const userInput = '<p>Hello</p><script>alert("XSS");</script>';
const safeInput = encodeHTML(userInput);
console.log(safeInput); // 输出: &lt;p&gt;Hello&lt;/p&gt;&lt;script&gt;alert(&quot;XSS&quot;);&lt;/script&gt;