4 ms·
How would you protect against that ? is encoding the output enough ?
by sirrocco 16y ago
How would you protect against that ? is encoding the output enough ?
- Xk 16y agoSanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to "e;, etc. As long as all they can write is normal characters then you're safe [1]. [1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.
- codingthewheel 16y agoSanitize everything, use multiple redundant sanitizer libraries (there are several out there that handle different things), and use a whitelist, rather than a blacklist, based approach. If you want to allow the use of <a> tags, enforce that they adhere to the exact format of a safe <a> tag, otherwise encode or strip them. One look at the XSS cheatsheet page should be enough to convince any sane developer of the futility of a blacklist-based approach.