new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

input_validation/xss

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Input validation not primary safeguard against XSS

Input validation is not the primary safeguard against Cross-Site Scripting. Proper context-aware output encoding is the primary means, since users may have legitimate reasons to type characters like apostrophe or less-than sign in their comments and the application must properly handle it throughout the whole lifecycle of the data.

Output encoding for XSS prevention

All user data controlled must be encoded when returned in the HTML page to prevent the execution of malicious data. For example <script> would be returned as &lt;script&gt;. The type of encoding is specific to the context of the page where the user controlled data is inserted. HTML entity encoding is appropriate for data placed into the HTML body. User data placed into a script would need JavaScript specific output encoding.

Give your agent this brain