Quantcast

ASP.NET: Remove HTML Tags From a String

Get the WebProNews Newsletter:
[ Business]

A lot of websites allow users to input text and submit it to the site.

This could be forums, blogs, content management systems etc.

Imaging if the user writes HTML into these form fields?

It could be perfectly harmless when used for styling, but it could also be used the wrong way.

A typical scenario would be when a user enters JavaScript that does harmful things or embedding a style sheet that ruins the websites layout.

This is normally referred to as Cross-Site Scripting (XSS).

We have to mitigate that risk, and that’s when regular expression comes to the rescue.

Here is a very simple method that strips all HTML tags from a string or just the harmful tags – you decide.

The method takes two parameters: the string that needs tag removal and a boolean flag that determines if harmless tags are allowed or not.

public static string StripHtml(string html, bool allowHarmlessTags)
{
   if (html == null || html == string.Empty)
     return string.Empty;

   if (allowHarmlessTags)
     return System.Text.RegularExpressions.Regex.Replace(html, "", string.Empty);

   return System.Text.RegularExpressions.Regex.Replace(html, "<[^>]*>", string.Empty);
}

You can add more harmful tags to the regular expression string if you’d like.

Enjoy.

Try the demo

Tag:

Add to Del.icio.us | Digg | Reddit | Furl

Bookmark WebProNews:

Mads Kristensen currently works as a Senior Developer at Traceworks located
in Copenhagen, Denmark. Mads graduated from Copenhagen Technical Academy with a multimedia degree in
2003, but has been a professional developer since 2000. His main focus is on ASP.NET but is responsible for Winforms, Windows- and
web services in his daily work as well. A true .NET developer with great passion for the simple solution.

http://www.madskristensen.dk/

ASP.NET: Remove HTML Tags From a String
About Mads Kristensen
Mads Kristensen currently works as a Senior Developer at Traceworks located in Copenhagen, Denmark. Mads graduated from Copenhagen Technical Academy with a multimedia degree in 2003, but has been a professional developer since 2000. His main focus is on ASP.NET but is responsible for Winforms, Windows- and web services in his daily work as well. A true .NET developer with great passion for the simple solution.

http://www.madskristensen.dk/ WebProNews Writer
Top Rated White Papers and Resources
  • http://DerekHyams.com Derek Hyams

    i dont  know if you realised but using your HTML remover also makes the whole text lowercase, i can see why you have used it, to remove uppercase and lowercase < br >’s  but it outputs the text as lowercase…

    Just a note..

    Kind Regards,

    Derek Hyams

  • http://anmobi.com Theme

    Good job Mads

  • Guest

    dd

  • Guest

    Function sendOutputWithoutHTMLTags(ByVal inputString As String)
    Dim newString As String = “”
    Dim stringCharArray As Char() = inputString.ToCharArray
    Dim strLength As Integer = inputString.Length

    For n As Integer = 0 To (strLength – 1)
    If stringCharArray(n) = “< " Then
    While stringCharArray(n) <> “>”
    n = n + 1
    End While
    n = n + 1
    End If
    newString += stringCharArray(n)
    Next
    Return newString
    End Function

  • Guest

    Have a look on my own implementation of PHP’s strip_tags function here -> http://www.codeproject.com/KB/MCMS/htmlTagStripper.aspx 

  • http://kredyt-hipoteczny.edu.pl hipoteczne

    Hi. I’m interested in a subject of this site. I want to say thanks to the author.
    ! THANKS ! If you want check mine: informacje or

  • msk

    Thanks alot

  • Amol Pandit

    Very Good job Mads :)

  • http://www.vtt-occasion.fr vtt
  • Guest

    www.gazeteoku.6te.net
    Gazeteler K?br?s ,Azeri Gazeteleri televizyonlar radyolar yabanc? medya,canl? tv izleme,g

  • Guest

    I switched your code to VB and used it without any side-effects. Thank you!!

  • Guest
  • http://www.webwizo.com Asif Iqbal

    Oh man you saved my time. I had been looking this method since long time..

    Anyways, Thank you!

  • http://deditalk.com/member.php?50145-DeteDiminip getting ex back after months

    you’re really a just right webmaster. The site loading velocity is amazing. It kind of feels that you are doing any unique trick. In addition, The contents are masterpiece. you’ve performed a excellent task in this matter!

  • http://fitness.automaticbacklinkcreatorv2.info Jaqueline Greenspan

    I saw this on another post and it made me smile
    The more you complain, the longer God makes you live. :)

  • Join for Access to Our Exclusive Web Tools
  • Sidebar Top
  • Sidebar Middle
  • Sign Up For The Free Newsletter
  • Sidebar Bottom