Besides what Jim said...
The problem with using JavaScript validation is a simple one: People can simply TURN OFF JavaScript in their browsers and your validation is then worthless. (They can also spam you using non-browser systems, and again
JS validation is worthless.)
You *NEED* to *ALSO* do the validation in your ASP code, in VBScript.
It's not hard. You can use the same kind of regular expression(s) you do in
JS.
For example:
Code:
<%
...
' strip all HTML content out of user comment
Dim reStrip
Set reStrip = New RegExp
reStrip.Pattern = "\<\/?[A-Za-z][^\>]*\>"
reStrip.Global = True
comments = reStrip.Replace( Request("comments"), "" )
...
%>
That will strip *all* HTML tags from the comment. If the user puts in something like
<a href="...some **** site...">Click here!</a>
then all that is left in his comment is
Click here!
Which might be annoying to read, but at least it won't be a usable link.
Same with <script> tags. The script will still be there, but it will be ineffective.
If you want to do more than this (i.e., actually strip out all the content of <script>...</script>) that's not too hard, either, but requires making a list of the tag pairs you want to strip from & doing one at a time.
how to stop comment spam
