Regex match for HTML tag containing "on" JS trigger

Question

I want to check if an HTML tag (potentially split across multiple lines) contains an "on" JS trigger. The actual HTML tag and the Javascript are of no consequence. For example:

    <img src="foo.jpg" onblur="foo()"/>Other stuff

I've got most of this to work using the pattern:

    <\w+([^>])+?(on\w+)+[\s\S]+?>

However, this also matches:

    <p style="font-size:11px;">Other stuff</p>

I modified the original pattern to:

    <\w+([^>])+?(\s)+(on\w+)+[\s\S]+?>

but this matches only if the JS trigger keyword is preceded by 2 or more whitespace characters. A nudge in the right direction would be appreciated.

@ExplosionPills I want to filter potentially hazardous HTML. — Ravi Bhavnani, Dec 06 '13 at 17:56
[I don't care how old this question is, this is the only right answer.](http://stackoverflow.com/a/1732454/4532996) — cat, Dec 25 '15 at 14:31
@cat I didn't want to parse HTML. I just wanted to check for the presence of JS containing an "on" trigger. — Ravi Bhavnani, Dec 26 '15 at 22:16
Yes, you're trying to parse HTML, and you should use an HTML engine not regex. — cat, Dec 26 '15 at 22:27

score 0 · Accepted Answer · answered Dec 06 '13 at 17:11

0

Might work <\w+(?=\s)[^>]*?\s(on\w+)[\s\S]+?>

answered Dec 06 '13 at 17:11

score 0 · Answer 2 · answered Dec 06 '13 at 17:21

0

(?m)(?i).*(?=([^a-z]on)).*>

Try this will match the html if it contains an on but wont match it if it is mid word

answered Dec 06 '13 at 17:21

Srb1313711

2,017
5
24
35

The multi-line modifier won't let the last `.*`> span newlines (if it had to match > next). – Dec 06 '13 at 17:40

Regex match for HTML tag containing "on" JS trigger

2 Answers2