4 ms·
Sanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to "e;, etc. As long as all they can write is normal chara
by Xk 16y ago
Sanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to "e;, etc. As long as all they can write is normal characters then you're safe [1].
[1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.
- codingthewheel 16y agoSanitize everything, use multiple redundant sanitizer libraries (there are several out there that handle different things), and use a whitelist, rather than a blacklist, based approach. If you want to allow the use of <a> tags, enforce that they adhere to the exact format of a safe <a> tag, otherwise encode or strip them. One look at the XSS cheatsheet page should be enough to convince any sane developer of the futility of a blacklist-based approach.