Re: Preventing cross site scripting

> To prevent CSS attacks, it is the most simple and trivial thing; Simply

I like your idea. :) However, it would break some HTML pages that already contains some examples of HTML code etc.

Perhaps it should be done in three steps:

1. Change all < > to &foolt; and &foogt; corresponding
2. Put back all allowable HTML tags i.e. &foolt;BODY&foogt; (using regex or sth else to filter out unwanted attributes)
3. Change all remaining &foolt; to &lt; and &foogt; to &gt;

Cheers,
wp

-- 
Wojciech Purczynski
iSEC Security Research
http://isec.pl/