To filter out HTML, the following regex pattern is used for attribute names [\w:] This only allows the underscore and colon in addition to letters. In particular, the hyphen, which occurs very frequently in attribute names, is missing. The pattern [\w:-] should therefore be used as a minimum. However, some other characters are permitted according to HTML5. I therefore recommend the use of the pattern [^\x00-\x20\x3e\x7f\/\=] instead for any attribute name detection.
Example:
<a data-foo="bar" href="https://example.org">Hello World</a>
This is currently not recognized as HTML and the attribute value "https://example.org" is translated into a link.
https://www.w3.org/TR/2011/WD-html5-20110525/syntax.html#syntax-attribute-name
To filter out HTML, the following regex pattern is used for attribute names
[\w:]This only allows the underscore and colon in addition to letters. In particular, the hyphen, which occurs very frequently in attribute names, is missing. The pattern[\w:-]should therefore be used as a minimum. However, some other characters are permitted according to HTML5. I therefore recommend the use of the pattern[^\x00-\x20\x3e\x7f\/\=]instead for any attribute name detection.Example:
This is currently not recognized as HTML and the attribute value "https://example.org" is translated into a link.
https://www.w3.org/TR/2011/WD-html5-20110525/syntax.html#syntax-attribute-name