title: Malicious code injection: Is it safe enough to remove script tags by regex?
body: <p>So I've set up a page where people can submit tutorials. These tutorials are built basically by a TinyMCE editor.</p>
  
  <p>Anyway one could abuse it and just POST their own, non escaped text and insert some malicious <code>&lt;script&gt;</code>.</p>
  
  <p>So my question is: would it be safe enough to remove <code>&lt;script&gt;</code> tags with an regular expression? I would run this regex on my backend, before storing it.</p>
  
  <p><a href="https://stackoverflow.com/questions/6659351/removing-all-script-tags-from-html-with-js-regular-expression">I've found</a> this expression for example</p>
  
  <pre><code>&lt;script\b[^&lt;]*(?:(?!&lt;\/script&gt;)&lt;[^&lt;]*)*&lt;\/script&gt;
  </code></pre>