title: xss javascript protection
body: <p>So i am using the jQuery UI library to open new dialog windows, when the new dialog windows are opened I am passing some parameters like this</p>
  
  <pre><code>&lt;a href="http://www.mysite.com/custompage.html?width=100&amp;height=200&amp;param1=abc&amp;param2=http://www.anothersite.com&amp;param3=custom3"&gt;open modal&lt;/a&gt;
  </code></pre>
  
  <p>The site works fine and no issues at all, my custompage.html just picks up those values that were passed and they are being used on the page, something like this:</p>
  
  <pre><code>var a = customfunctionget(param1); var b = customfunctionget(param2)....
  </code></pre>
  
  <p>I just received a report that we are vulnerable to Cross-Site Scripting attacks by replacing any of the params with something like this:</p>
  
  <pre><code>&gt;&lt;script&gt;alert(123)&lt;/script&gt;&lt;param 
  </code></pre>
  
  <p>Which I understand correctly what is supposed to happen but on any browser that I try to inject the script the alert is never displayed so the "script/injection" is not being processed, the custompage.html stops working as expected since we need the values to be entered correctly but there is nothing I can do on that respect.</p>
  
  <p>Is there a magic pill that I am missing here? Most of the XSS information that I find does the same thing, try to inject an alert through a tag but other than me denying to display any content if the parameter is not well formed I dont know what else can be done.</p>
  
  <p>Any recommendations, tutorials welcome.</p>