XSS Attacks Prevention

Question

I've found a "database" of many XSS attacks and while this list provides quite a big list of attacks are there are any other attacks that didn't fall in the XML, what to look out for and most unexpected?

Answer 1

Not sure exactly what you're looking for, but if you want to prevent XSS attacks on your site, I would say don't allow HTML at all. If you want to allow HTML, see how StackOverflow does it.

You might find a few things that the other site missed here.

Answer 2

It is a very extensive topic and need detailed and up to date knowledge of the techniques used by hackers for accomplishing XSS. But to begin with you should not trust anything user inputs. Take it as potential attempt to hack your site or corrupt your database.

You can use many cleaning tools available to remove potential malicious input like:

for asp.net Microsoft Anti-XSS library, HTML Agility Pack from codeplex.

for PHP you can certainly use HTMLPurifier. It is very nice and capable tool.

Answer 3

I've used HTML Purifier to allow users to input only specific, safe, HTML into comment text boxes before. It does a very nice job, and has very good documentation.

For everything else, like a simple text box, or select box, when writing the value to the page I always run it through htmlentities():

htmlentities ($_POST['email'], ENT_QUOTES);

As long as all user submitted data is always written to the page using htmlentities() you should never have an XSS problem.