> Blacklist input validation as defense against XSS? Are you kidding me? Where are you seeing that? The advice I can see talks about escaping HTML rather than

> Blacklist input validation as defense against XSS? Are you kidding me? Where are you seeing that? The advice I can see talks about escaping HTML rather than blacklisting input validation: https://www.hacksplaining.com/prevention/xss-stored https://www.hacksplaining.com/prevention/xss-stored Unfortunately it doesn't discuss escaping Javascript nor CSS. But it least it covers the most common case.