Out with Regex, In with Tokens

Parsing user input, creative data, and HTML is hard. I'm sure you've whipped up some pretty creative regular expressions that //almost// work //most// of the time when dealing with these things, but it's often easy for attackers, or even non-malicious end-users to trip up your carefully crafted regex and make your pages look horrible (or worse). In this talk, we'll discuss a few practical examples of how taking a token-based approach to parsing code and markup can save you plenty of time in the long run, and more importantly, will actually prevent your replacements from failing.