Assume all data entered by users is malicious and encode it properly on display. That's really all there is to it.

Amen to that.

Everyone overcomplicated the issue, it's not a difficult issue to solve: whenever untrusted data is to be displayed to a user, escape it. Problem solved.

Tools like Paros http://www.parosproxy.org/index.shtml will spider/scan for some common attack patterns.

It's also definitely nice to have a dedicated qa person (preferably someone familiar with the code) trying to break your site, both manually and with tools like Selenium http://seleniumhq.org/

For people using Rails, sanitize all input before it goes in. Here's a library for web params. http://code.google.com/p/sanitizeparams/

so when some new technique comes out down the road that your input filtering didn't catch, are you going to update everything in your database? and what about data that gets in from other sources?

i don't see the benefit in filtering input; html and alert()'s inside a database don't affect anything until they come back out.

The benefit to filtering input is that it is less error prone for programmers. The filter on output method that most Rails programmers use involves setting it up on an output-by-output method. I like the input technique because it only needs to be configured once.

I think the risk of new techniques getting by this filter are low (although the risk of the filter having bugs is high, as judged by the number of bugs that popup in more critical software). In XSS there are only a limited set of attack vectors (iframe, javascript, flash), and those get filtered completely. The underlying filter is based on whitelisting, so it's not like new additions to the HTML spec are going to open security holes before we have a chance to close them (it's the opposite, new, safe HTML additions will need to be explicitly allowed before they can be used).

Also, proper sanitization is different for HTML, JavaScript, SQL, URIs, and other contexts.

The question is specifically about XSS, so the context is by definition HTML and Javascript.

I would pay someone like me to assess your code and pentest your site :)

If you're planning on doing this yourself, OWASP (www.owasp.org) is a great resource.