title: filter metacharacters from user input in xss attack
body: <p>on my site on the admin login page if i do something like this</p>
  
  <pre><code>http://www.domain.com/admin/index.php/%22onclick=document.location="http://www.google.com"&gt;
  </code></pre>
  
  <p>and click somewhere the page actually redirects. i read somewhere that i need to filter metacharacters. but after hours of googling i cant find out how i can stop this. the above from what i see isnt doing a get or post. how can i block something like this?</p>