Question: I'm trying to strip all html tags from string and keep only specific (keep the tag and the attributes),
I have this:

```
set objRegExp = new RegExp
with objRegExp
.Pattern = "<^((b)|(i)|(em)|(strong)|(br)|(img))>.*</.*>"
.Global = True
end with

```

and using:

```
objRegExp.replace(request.form("content"), "") 

```

doesn't change anything.

I need this for a forum that I build, which supports WYSIWYG editor and I want to prevent xss & sql injections.

Answer: 
To strip all HTML Tags: 

```
Public Function RegexAllHtml(strValue)
   Set RegularExpressionObject = New RegExp
   With RegularExpressionObject
    .Pattern = "<(.|\n)+?>"
    .IgnoreCase = True
    .Global = True
   End With
   Dim strResult: strResult = RegularExpressionObject.Replace(strValue, " ")
   Set RegularExpressionObject = Nothing

   RegexAllHtml = strResult
End Function

```

To remove specific tags (eg. SPAN) you could use something like:
`<SPAN[^><]*>|<.SPAN[^><]*>`

Or to keep specific tags (eg. b an bold): `<(?!/?(?:strong|b)\b)[^>]*>`

BTW: Most WYSIWG editors let you configure which tags are not safe and those then are removed before saving the content! See for example CKEditor: <http://docs.ckeditor.com/#!/api/CKEDITOR.config-cfg-allowedContent>
Function RegexAllHtml... is...

If the string contains the string "<spec...>" it will be removed. I don't think it's a valid function.
Should we warn users not to use "<" and ">" individually?