   [web] Solutions for XSS Attacks?
  Anyone ever written up solutions to protect a site against Cross site scripting attacks? Looking for solutions for asp pages, pages that contain &#106avascript, and asp.net pages.   
  Well XSS was a new term for me, so I went ahead to read the wikipedia article. It seems to be mostly preventable with simple form & input validation. In ASP, use the replace function to replace one single quote with 2 (to prevent sql injection). Also look up validation for special characters, to make sure nothing else can cause problems with your data. Things like a captcha can help prevent against bots using your forms as well in inject damaging data data.   ;  Actually, the ONLY way to prevent XSS is to recreate the DOM using a whitelist approach. Escaping and regex blacklisting does NOT work. Check out HTMLPurifier for an excellent example of a library that does this.   ;  use POST not GET.  in your forms include a hidden input field that has the session id for the value.  just have to be careful not to expose the session id (i.e. non-filtered error messages common way to do this).  treat _all_ user entered input as dirty until escaped.   