How to Prevent Cross-Site Scripting (XSS) Attacks

XSS is a type of code injection very similar in nature to SQL injection. Like protecting against any code injection attack, the best defense is thorough and well-tested santization of any and all user input. Site owners need to determine every input path by which their web site accepts incoming data. Each path must be hardened against malicious data that can represent executable code. Often this requires implementing mulitple filters along the communication pathway – for example, a web application firewall such as ModSecurity plus input sanitization within server-side input processing code.