CODEWITHSUNDEEP
securityxss
dpb
dpb

Reputation: 353

XSS - Does blacklisting of following characters take good enough care of XSS?

I am blacklisting following characters for a variable which becomes part of the URL.

Please suggest if I am missing any or should exclude any.

"~!@#$%^*()+{}[]|<>\"\\:;,"

Upvotes: 0

Views: 63

Answers (1)

ircmaxell
ircmaxell

Reputation: 165201

No it does not.

Also, never try to do security through blacklists. Use whitelists.

And never try to filter for XSS. Encode your output for the format you're writing to. For HTML (body and quoted attributes) then use something like php's htmlspecialchars().

Upvotes: 3

Related Questions