voku\helper\AntiXSS::remove_disallowed_javascript PHP Method

remove_disallowed_javascript() private method

Note: It was reported that not only space characters, but all in the following pattern can be parsed as separators between a tag name and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C] ... however, UTF8::clean() above already strips the hex-encoded ones, so we'll skip them below.
private remove_disallowed_javascript ( string $str ) : string
$str string
return string
    private function remove_disallowed_javascript($str)
    {
        do {
            $original = $str;
            if (preg_match('/<a/i', $str)) {
                $str = preg_replace_callback('#<a[^a-z0-9>]+([^>]*?)(?:>|$)#i', array($this, '_js_link_removal'), $str);
            }
            if (preg_match('/<img/i', $str)) {
                $str = preg_replace_callback('#<img[^a-z0-9]+([^>]*?)(?:\\s?/?>|$)#i', array($this, '_js_img_removal'), $str);
            }
            if (preg_match('/script|xss/i', $str)) {
                $str = preg_replace('#</*(?:script|xss).*?>#si', $this->_replacement, $str);
            }
        } while ($original !== $str);
        return (string) $str;
    }