Whoever it was that fixed the XSS (necro?), I'm impressed how fast that was. But please don't rely on just escaping < and >. You have to worry about double-quo

Whoever it was that fixed the XSS (necro?), I'm impressed how fast that was. But please don't rely on just escaping < and >. You have to worry about double-quotes too, I can end a string and add a "onload" or "onfocus" attribute if it's already in a tag. And sometimes you have to worry about single quotes. In fact, there's a lot to take a look at. Instead of just fixing the case at hand, try to be proactive about it. Check to make sure you don't have anything else. Edit: Click the search box, for example. http://www.pinkbike.com/forum/search/?q=%22%20onclick=%22alert%28%27xss%27%29%22%20foo=%22 http://www.pinkbike.com/forum/search/?q=%22%20onclick=%22ale...