Re: [WEB SECURITY] xss filter to protect from xss attacks

["Lalit Patel" <lalitpatel@xxxxxxxxx>]

Hi All,

Can the XSS problem (both avoiding and filtering) be minimized if we
accept only XHTML from the user? I mean if we create a custom DTD and
then validate the user input against that.

For example
If we allow only <b> (bold) or <i> (italic) tag, we may validate the
input against that DTD.

Regards,
Lalit Patel
--
http://www.lalit.org

----------------------------------------------------------------------------
The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]