The benefit to filtering input is that it is less error prone for programmers. The filter on output method that most Rails programmers use involves setting it u

The benefit to filtering input is that it is less error prone for programmers. The filter on output method that most Rails programmers use involves setting it up on an output-by-output method. I like the input technique because it only needs to be configured once. I think the risk of new techniques getting by this filter are low (although the risk of the filter having bugs is high, as judged by the number of bugs that popup in more critical software). In XSS there are only a limited set of attack vectors (iframe, javascript, flash), and those get filtered completely. The underlying filter is based on whitelisting, so it's not like new additions to the HTML spec are going to open security holes before we have a chance to close them (it's the opposite, new, safe HTML additions will need to be explicitly allowed before they can be used).