> Although there are better ways to accomplish what you need to do, the immediate way to fix this is to validate the errmsg parameter to make sure it only conta

> Although there are better ways to accomplish what you need to do, the immediate way to fix this is to validate the errmsg parameter to make sure it only contains safe values. This means that there should be no <, > &, " or ' characters in this parameter. No! XSS is an encoding failure. Don't try to solve it with sanitization. That leads to silly situations like users named O'Malley getting errors because you don't allow quotes in names. Sanitization is for controlling the structure of data, like making sure names aren't a million characters long, or making sure all orders have at least one order line. It prevents situations that shouldn't be possible, that aren't sane. Get it? "Encoding" means representing data in different ways, for instance so it can be stored/transported in a stream. Raw string: <>&"' XML-encoded: &lt;&gt;&amp;&quot; JSON-encoded: <>&\"' URL-encoded: %3C%3E%26%22' SQL-encoded: <>&"\' CSV-encoded: <>&""' Same string, different representations. That's encoding.