News for hackers. Stuff that matters.

A comment on XSS (Cross Site Scripting) Cheat Sheet. Parent comment

Re:XSS (Cross Site Scripting) Cheat Sheet by Swizec on Monday February 13, 2012 @05:18PM (#3587568)
A very good thing to consider when trying to write a sanitisation regex:

HTML is not a regular language.

Programming languages are not a regular language.

Generally if there are opening and closing statetements -> it is not a regular language.

Something that isn't a regular language, cannot be handled by regex.

[ Parent | on HN ]
Re:XSS (Cross Site Scripting) Cheat Sheet by jwatzman on Monday February 13, 2012 @10:54PM (#3588532)
Unfortunately what we nowadays call "regular expressions" aren't the regular expressions from math class -- they can match against much more than regular languages. I believe PCRE, i.e., the "regular expression" language for most regex libraries, is Turing-complete though I can't find a citation for that right now.
[ Parent | on HN ]