News for hackers. Stuff that matters.

A comment on Ask HN: Testing your site for XSS exploits.

Re:Ask HN: Testing your site for XSS exploits by planck on Thursday August 13, 2009 @06:00PM (#761792)
Assume all data entered by users is malicious and encode it properly on display. That's really all there is to it.
[ Parent | on HN ]
Re:Ask HN: Testing your site for XSS exploits by pwmanagerdied on Thursday August 13, 2009 @06:08PM (#761804)
Amen to that.

Everyone overcomplicated the issue, it's not a difficult issue to solve: whenever untrusted data is to be displayed to a user, escape it. Problem solved.

[ Parent | on HN ]