Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script> " onload="alert(4)" ...
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
No. This doesn't stop all injections.
You mentioned one example:
The regexp you listed is not enough to stop XSS in that case; an attacker could inject
//www.evil.com/kablooey.js, and you're done for. (Comment: the URL
//www.evil.com/kablooey.js is treated by browsers as equivalent to
http://www.evil.com/kablooey.js, if the containing page was served over http.)
In general, I recommend reading the OWASP recommendations on how to prevent XSS. Sanitize your inputs, and use context-dependent escaping of all outputs (e.g., all values inserted into HTML).