<cfcomponent> <cffunction name="init" access="public" returntype="inputValidation" description="Default init method."> <cfreturn this /> </cffunction> <cffunction name="inputCleaner" access="public" returntype="any" description="Takes any type of value and cleans its input for bad tags."> <cfargument name="dirty" type="any" default="" hint="Dirty item(s) to be cleaned."> <cfset var clean = arguments.dirty /> <cfif IsStruct(arguments.dirty)> <cfloop collection="#arguments.dirty#" item="key"> <cfset clean[key] = CleanInput(StructFind(arguments.dirty, key))> </cfloop> <cfelseif IsArray(arguments.dirty)> <cfloop index="index" from="1" to="#arrayLen(arguments.dirty)#"> <cfset clean[index] = CleanInput(arguments.dirty[index])> </cfloop> <cfelseif IsQuery(arguments.dirty)> <!--- INPUT METHOD TO CLEAN QUERY OBJECTS ---> <cfelse> <cfset clean = CleanInput(arguments.dirty)> </cfif> <cfreturn clean /> </cffunction> <cffunction name="CleanInput" access="public" returntype="string" description="Cleans user input for bad tags, replaces with HTMLEditFormat."> <cfargument name="text" hint="Text" displayname="Text to be cleaned."> <cfscript> var mode = "escape"; //the things to strip out (badTags are HTML tags to strip and badEvents are intra-tag stuff to kill) //you can change this list to suit your needs // -=TEMPORARY REMOVED:: EMBED,APPLET,OBJECT, ::TEMPORARY REMOVED=- // <cfargument name="mode" default="strip"> var badTags = "SCRIPT,LAYER,ILAYER,IFRAME,FRAME,FRAMESET,JAVASCRIPT,FORM,PARAM,INPUT,META,CF,XML"; var badEvents = "onClick,onDblClick,onKeyDown,onKeyPress,onKeyUp,onMouseDown,onMouseOut,onMouseUp,onMouseOver,onBlur,onChange,onFocus,onSelect,javascript:"; var stripperRE = ""; //set up variable to parse and while we're at it trim white space var theText = trim(arguments.text); //find the first open bracket to start parsing var obracket = find("<",theText); //var for badTag var badTag = ""; //var for the next start in the parse loop var nextStart = ""; //if there is more than one argument and the second argument is boolean TRUE, we are stripping if(arraylen(arguments) GT 1 AND isBoolean(arguments[2]) AND arguments[2]) mode = "strip"; if(arraylen(arguments) GT 2 and len(arguments[3])) badTags = arguments[3]; if(arraylen(arguments) GT 3 and len(arguments[4])) badEvents = arguments[4]; //the regular expression used to stip tags stripperRE = "</?(" & listChangeDelims(badTags,"|") & ")[^>]*>"; //Deal with "smart quotes" and other "special" chars from MS Word theText = replaceList(theText,chr(8216) & "," & chr(8217) & "," & chr(8220) & "," & chr(8221) & "," & chr(8212) & "," & chr(8213) & "," & chr(8230),"',',"","",--,--,..."); //if escaping, run through the code bracket by bracket and escape the bad tags. if(mode is "escape"){ //go until no more open brackets to find while(obracket){ //find the next instance of one of the bad tags badTag = REFindNoCase(stripperRE,theText,obracket,1); //if a bad tag is found, escape it if(badTag.pos[1]){ theText = replace(theText,mid(TheText,badtag.pos[1],badtag.len[1]),HTMLEditFormat(mid(TheText,badtag.pos[1],badtag.len[1])),"ALL"); nextStart = badTag.pos[1] + badTag.len[1]; } //if no bad tag is found, move on else{ nextStart = obracket + 1; } //find the next open bracket obracket = find("<",theText,nextStart); } } //if not escaping, assume stripping else{ theText = REReplaceNoCase(theText,stripperRE,"","ALL"); } //now kill the bad "events" (intra tag text) theText = REReplaceNoCase(theText,'(#ListChangeDelims(badEvents,"|")#)[^ >]*',"","ALL"); //return theText return theText; </cfscript> </cffunction></cfcomponent>