XSS in Drupal 7 Views Replacement token I am working on a Drupal 7 site that uses a replacement pattern %1 inside a View header to generate a URL with the Organic Group id(og_group_ref).

The view header markup is 

&lt;a class="ct" href="/node/add/post?og_group_ref=%1"&gt;Create Convo&lt;/a&gt;


Example URL of a page is site/b_posts/2, so the link created would be /node/add/post?og_group_ref=2.

This is vulnerable to XSS, since accessing the URL site/b_posts/%22%20onmouseover=%22alert%28559%29%22%20test=%22/2 would result in a JS alert getting executed on mousing over the link. How to protect against this? I used the latest version of Views and this is still happening.
You must enable validation on your contextual filter.

More information found here:

https://drupal.org/node/1578564

http://nodeone.se/en/learn-views-with-nodeone-part-23-validation-of-contextual-filter-input