title: Is escaping < and > sufficient to block XSS attacks?
body: <p>I'm sure that the answer to this question is No, but I can't seem to find a way that simply transforming <code>&lt;</code> and <code>&gt;</code> to <code>&amp;lt;</code> and <code>&amp;gt;</code> doesn't completely block reflected and persistent XSS.</p>
  
  <p>I'm not talking about CSRF.</p>
  
  <p>If this doesn't block XSS, can you provide an example of how to bypass this defence?</p>