CERT.org: Understanding Malicious Content Mitigation for Web Developers

“CERT Advisory CA-2000-02 describes a problem with malicious
tags embedded in client HTTP requests, discusses the impact of
malicious scripts, and offers ways to prevent the insertion of
malicious tags.”

“This tech tip, written for web developers, describes more
specifically the steps you can take to prevent attackers from from
using untrusted content to exploit your web site.”

“Any server that creates web pages by inserting dynamic data
into a template should check to make sure that the data to be
inserted does not contain any special characters (e.g., “<“). If
the inserted data contains special characters, the user’s web
browser will mistake them for HTML markup. Because HTML markup can
introduce programs, the browser could interpret some data values as
HTML tags or script rather than displaying them as text.”

“The risk of a web server not doing a check for special
characters in dynamically generated web pages is that in some cases
an attacker can choose the data that the web server inserts into
the generated page. Then the attacker can trick the user’s browser
into running a program of the attacker’s choice.”

Complete
story.