Question

I’m working on a simple project to teach about XSS. I’m trying to make a regex that will catch
<script>alert('anything')</script>;

I crafted: <script>alert\(\'[\w!@#$%^&*()-=+]+\'\);</script> but when i try to implement it in php I get errors yet when I try it in a regex tool it says it matches my string.

Anyone know how to make a regex that works?

Thanks

Answer 1

I would guess it is because you aren’t escaping some of the characters in your expression. I think the following regex should work for you:

 /\<script\>.*\<\/script\>;/

The following metacharacters are supposed to be escaped in regex:

^ [ . $ { * ( \ + ) | + ) < >

Like:

\^ \[ \. \$ \{ \* \( \\ \+ \) \| \+ \) \< \>