Sanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to "e;, etc. As long as all they can write is normal characters then you're safe [1].
[1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.
Sanitize everything, use multiple redundant sanitizer libraries (there are several out there that handle different things), and use a whitelist, rather than a blacklist, based approach. If you want to allow the use of <a> tags, enforce that they adhere to the exact format of a safe <a> tag, otherwise encode or strip them. One look at the XSS cheatsheet page should be enough to convince any sane developer of the futility of a blacklist-based approach.
Comments
> Problem is, there are a lot of ways to say document.cookie
Could you give an example?
Using the converter linked above[1] I can convert
to the equivalentHow would you protect against that ? is encoding the output enough ?
Sanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to "e;, etc. As long as all they can write is normal characters then you're safe [1].
[1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.
Sanitize everything, use multiple redundant sanitizer libraries (there are several out there that handle different things), and use a whitelist, rather than a blacklist, based approach. If you want to allow the use of <a> tags, enforce that they adhere to the exact format of a safe <a> tag, otherwise encode or strip them. One look at the XSS cheatsheet page should be enough to convince any sane developer of the futility of a blacklist-based approach.