Avoiding XSS

• The main defense is to filter all user input before sending it back to the browser

• In particular, it is recommended that these characters: < > ( ) & # be filtered

• • &lt; &gt; &#40; &#41 &amp; &#35; are substitutes
  • Usually the language has a function to call to do that for you: htmlentities(), cgi.escape(), etc.