title: Is the browser's X-XSS-Protection/XSS Auditor sufficient to prevent XSS?
body: <p>As I understand it, I would need to disable X-XSS-Protection in the headers server-side in order to prevent XSS from occurring via a GET request.</p>
  
  <p>For example, the user browses to </p>
  
  <pre><code>http://mysite.com/index.php?page=&lt;script type='text/javascript'&gt; alert("XSS"); &lt;/script&gt;
  </code></pre>
  
  <p>Assuming that $_GET['page'] is echoed to the page from PHP without being altered in any way, the XSS Auditor should catch that there is stuff from the request being echoed to the page and put a stop to it.</p>
  
  <p>Is this sufficient to prevent XSS attacks, or can this browser protection be bypassed by the attacker?</p>
  
  <p>Sufficient meaning that it is supported by all major browsers and is not bypassable.</p>