Regular expression
/<\s*script|javascript:|onerror\s*=|onload\s*=/Pattern breakdown
| Part | Meaning |
|---|---|
Anchor or context | Use anchors when you need whole-string validation. |
Main token | The core token sequence describes the accepted text shape. |
Character class | Character classes limit which characters are valid. |
Quantifier | Quantifiers control how many characters or groups are accepted. |
Flags | Use language-specific flags such as i, m, or u only when needed. |
Should match
<script>alert(1)</script>
Should not match
hellonot matching sample<script>alert(1)</script> invalidhello<script>alert(1)</script>
Test cases
| Input | Expected | Why it matters |
|---|---|---|
<script>alert(1)</script> | Match | Representative valid input for this pattern. |
hello | No match | Common invalid or boundary input. |
(empty string) | No match | Common invalid or boundary input. |
not matching sample | No match | Common invalid or boundary input. |
<script>alert(1)</script> invalid | No match | Common invalid or boundary input. |
hello<script>alert(1)</script> | No match | Common invalid or boundary input. |
JavaScript
const re = /<\s*script|javascript:|onerror\s*=|onload\s*=/;
re.test(input);Python
import re
bool(re.search(r"<\s*script|javascript:|onerror\s*=|onload\s*=", text))PHP
$ok = preg_match('/<\s*script|javascript:|onerror\s*=|onload\s*=/', $value) === 1;Java
Pattern pattern = Pattern.compile("<\\s*script|javascript:|onerror\\s*=|onload\\s*=");
pattern.matcher(value).find();Go
re := regexp.MustCompile(`<\s*script|javascript:|onerror\s*=|onload\s*=`)
ok := re.MatchString(value)Notes and production use
XSS Signal regex is useful as a practical starting point. Test it against your real input, avoid using it as the only security control, and prefer a parser when the format has complex grammar.
Performance tip: avoid running complex regular expressions repeatedly on very large untrusted strings without limits. Prefer anchored validation patterns, cap input length before matching, and use a parser when the target format has nested grammar.