title: Filter XSS by regular express
body: <p>I use ckeditor and open <code>source</code> item to user, therefore they can type something like <code>&lt;script&gt;alert(1)&lt;/script&gt;</code> in it, in the front-end we usually use <code>htmlspecialchars</code> to filter the HTML tag, but I need to let other html effect edited by user who correctly, therefore I need to write a function to filter all script tag to prevent xss attack.</p>
  
  <h3>PHP</h3>
  
  <pre><code>$content = 'This is the content &lt;script&gt;first&lt;/script&gt; and &lt;script&gt;second&lt;/script&gt; gogo';
  $pattern = '/&lt;script&gt;(.*)&lt;\/script&gt;/i';
  $content = preg_replace($pattern, '&amp;lt;script&amp;gt;$1&amp;lt;/script&amp;gt;gt;', $content);
  echo $content;
  </code></pre>
  
  <p>This is what I tried to do, but totally wrong, I need to convert <code>&lt;sctipt&gt;</code> and <code>&lt;script        &gt;</code> to <code>&amp;lt;script&amp;gt;</code></p>