Skip to main content
Castov
Authentication & Security · In-Browser Regular Expression Lab

XSS Regex — Detect Script Tags and Inline Event Handlers

Detects malicious `<script>` tags, javascript: pseudo-protocols, and inline event handlers (onload, onerror).

Flags:
//i
Match Found
Load Sample:
Match Inspection & Details1 match
Match #1:<script>alert('xss')</script>

Test Samples Verification Matrix

Expected Valid Samples (Should Match)

<script>alert('xss')</script> Pass
<img src=x onerror=alert(1)> Pass
<a href="javascript:evil()">click</a> Pass

Expected Invalid Samples (Must Reject)

hello world Rejected (Pass)
<p>Safe text</p> Rejected (Pass)
online banking Rejected (Pass)
Code Implementation Generator
// JavaScript / TypeScript (ES6+)
const pattern = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>|javascript:|on[a-z]+\s*=/i;
const text = "<script>alert('xss')</script>";

const isMatch = pattern.test(text);
console.log("Is Match:", isMatch);

if (isMatch) {
  const matches = text.match(pattern);
  console.log("Matches:", matches);
}

Regular Expression Token Breakdown

Flags classic `<script>` blocks, inline event handlers like `onerror=alert(1)`, and `javascript:` URIs. Each component of the regular expression serves a distinct syntactical purpose as mapped below:

Token PatternName / ComponentFunction & Rule
<script...<\/script>Script Tag BlockMatches entire script tag elements.
javascript:Pseudo-protocolDetects script execution in href/src attributes.
on[a-z]+\s*=Event HandlersMatches onload=, onclick=, onerror=, etc.

Frequently Asked Questions

What is the best defense against XSS?
HTML entity encoding and a robust Content Security Policy (CSP) headers.

Related Regular Expressions

Browse All 40 Patterns
Authentication & Security

SQL Injection Detection Pattern

Detects common SQL injection attempts including OR 1=1, UNION SELECT, comment dashes, and drops.

/('(''|[^'])*')|(;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|UNION)\b)|(\b(OR|AND)\b\s+['"\d]+[=<>]+['"\d]+)|(--|#|\/\*)/i
Test regex
Code & Markup

HTML Tags Matcher & Stripper

Matches HTML markup tags for sanitization, stripping, or token extraction.

/<\/?[a-zA-Z][a-zA-Z0-9]*(?:\s+[^>]*?)?\/?>/g
Test regex
Authentication & Security

Strong Password Policy

Enforces minimum 8 characters, at least one uppercase letter, one lowercase letter, one digit, and one special character.

/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&#])[A-Za-z\d@$!%*?&#]{8,}$/
Test regex