regex101: PCRE (Legacy) Match Workspace

Group 1(<.+?)

<the literal < (60₁₀ / 74₈ / 3C₁₆)

.+?any character (except for line terminators), repeated at least once

Positive Lookbehind(?<=\s)

\sany whitespace character

onthe literal text on (case insensitive)

Character Class[a-z]+

+matches at least one character from the set below:

a-zone character from a (97₁₀) to z (122₁₀) (case insensitive)

\s*any whitespace character, repeated any number of times

=the literal = (61₁₀ / 75₈ / 3D₁₆)

\s*any whitespace character, repeated any number of times

Non-Capturing Group(?:(['"])(?!\2).+?\2|(?:\S+?\(.*?\)(?=[\s>])))

1st Alternative(['"])(?!\2).+?\2

Group 2(['"])

Character Class['"]

'the literal ' (39₁₀ / 47₈ / 27₁₆)

"the literal " (34₁₀ / 42₈ / 22₁₆)

Negative Lookahead(?!\2)

\2the text saved by group 2

.+?any character (except for line terminators), repeated at least once

\2the text saved by group 2

2nd Alternative(?:\S+?\(.*?\)(?=[\s>]))

Non-Capturing Group(?:\S+?\(.*?\)(?=[\s>]))

\S+?any non-whitespace character, repeated at least once

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

.*?any character (except for line terminators), repeated any number of times

\)the literal ) (41₁₀ / 51₈ / 29₁₆)

Positive Lookahead(?=[\s>])

Character Class[\s>]

\sany whitespace character

>the literal > (62₁₀ / 76₈ / 3E₁₆)

Group 3(.*?>)

.*?any character (except for line terminators), repeated any number of times

>the literal > (62₁₀ / 76₈ / 3E₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

i modifier: insensitive. Matches without distinguishing uppercase and lowercase letters

Search reference

Regular Expression

(<.+?)(?<=\s)on[a-z]+\s*=\s*(?:(['"])(?!\2).+?\2|(?:\S+?\(.*?\)(?=[\s>])))(.*?>)

New

<meta name="keywords" content="keyword1, keyword2, keyword3">
<a href="something" onclick= "bad()">text</a> onclick not in tags
<a href="something" onclick =bad()>text</a>
<a href="something" onclick=bad('test')>text</a>
<a href="something" onclick=bad("test")>text</a>
<a href="something" onclick="bad()" >text</a>
<a href="http://mydomain.com/index.php?oninaval=12" class="titi">text</a>
What if I write john+onelia=love forever?

    <a href="something" onclick="bad()">text</a> onclick not in tags 
    <a href="something" onclick=bad()>text</a>
    <a href="something" onclick="bad()" >text</a>

<a href="something" onclick=a++ >text</a>

onclick="asd <span class="myclass"> not in tag too.</span>
<!-- onclick=" --><a href="something" onclick= "bad()">text</a>
<textarea><enter onclick="dothat()" text here></textarea>
yoko ono="john lennon"
<img src="/images/img1.jpg" alt="onclick=thegood() onclick=thebad() "/>
<img alt="onclick=" src=/images/theugly.jpg> the most important part of the message <p class="disappears"></p>

<a href="" onmouseover=a=7>button1</a>
<a href="something" onclick=a++>text</a>
<a href="something" onclick=a<<1>text</a>
<a href="" onmouseover="alert(a);">button2</a>

Regular Expressions 101

Regular Expression

Substitution