This is unfortunately very out of date now.
It is, however, a nice illustration of why your sanitisation regex probably isn't going to work as well as you'd like.
(Additional notes: http://stackoverflow.com/questions/1732348/regex-match-open-... )
It is, however, a nice illustration of why your sanitisation regex probably isn't going to work as well as you'd like.
(Additional notes: http://stackoverflow.com/questions/1732348/regex-match-open-... )
A lot of the payloads aren't based on browser "bugs" as such, more just the way browsers loosely interpret mangled HTML, CSS and JavaScript. Newer browsers tend to be stricter on what they'll interpret, especially when it comes to a potential XSS vector. The site doesn't seem to have been updated for anything after IE7 and Firefox 2, but I'm not aware of any better cheat sheets. Anyone got any?
HTML is not a regular language.
Programming languages are not a regular language.
Generally if there are opening and closing statetements -> it is not a regular language.
Something that isn't a regular language, cannot be handled by regex.