Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A very good thing to consider when trying to write a sanitisation regex:

HTML is not a regular language.

Programming languages are not a regular language.

Generally if there are opening and closing statetements -> it is not a regular language.

Something that isn't a regular language, cannot be handled by regex.



Unfortunately what we nowadays call "regular expressions" aren't the regular expressions from math class -- they can match against much more than regular languages. I believe PCRE, i.e., the "regular expression" language for most regex libraries, is Turing-complete though I can't find a citation for that right now.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: