CODEWITHSUNDEEP
html
Anil Namde
Anil Namde

Reputation: 6608

URI encode and HTML encode

If I have the xml/html data to post we need to encode the data to avoid the XSS validation. So should we use HTMLencode or URI encoding for this.

If URI encoding is used will it cause issues as form POST automatically URI encode all the data before sending.

Upvotes: 0

Views: 703

Answers (2)

Mathias Bynens
Mathias Bynens

Reputation: 149484

Remember: filter input, escape output.

  1. Always filter input before placing it in a database (to avoid SQL injection etc)
  2. Escape output before sending it to the client by filtering / encoding any HTML in the dynamic content.

Upvotes: 1

Quentin
Quentin

Reputation: 943100

XSS is a problem caused by giving tainted data to the client. It can't be solved at the point where data is posted.

To protect against it, HTML encode the data (immediately) before placing it in an HTML document.

Upvotes: 1

Related Questions