I'm trying to come up with a validation expression to prevent users from entering html or javascript tags into a comment box on a web page.

The following works fine for a single line of text:

^(?!.(<|>)).$

..but it won't allow any newline characters because of the dot(.). If I go with something like this:

^(?!.(<|>))(.|\s)$

it will allow multiple lines but the expression only matches '<' and '>' on the first line. I need it to match any line.

This works fine:

^[-_\s\d\w"'.,:;#/&\$\%\?!@+*\()]{0,4000}$

but it's ugly and I'm concerned that it's going to break for some users because it's a multi-lingual application.

Any ideas? Thanks!