Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script> " onload="alert(4)" ...
No. This doesn't stop all injections.
You mentioned one example:
The regexp you listed is not enough to stop XSS in that case; an attacker could inject
In general, I recommend reading the OWASP recommendations on how to prevent XSS. Sanitize your inputs, and use context-dependent escaping of all outputs (e.g., all values inserted into HTML).
|show 1 more comment|