Today I looked into defenses against Cross Site Scripting. I ran into ha.ckers.org which apparently OWASP references. I hear that ha.ckers.org page is quite well known.
Based on that research, I glean several things. Below are the highlights.
- Avoid allowing < or > symbols if at all possible.
- When you must accept HTML content, scrub input with HTMLPurifier.
- Avoid putting user-input content into HTML attributes. All types of attacks are possible using ampersands and such.
- Scrub all output and escape HTML entities.
- Using a black-list filter is a really bad idea.
I may report more in depth in the future.
