Avoid XSS Attack - Preventing Cross Site Scripting Attack
Cross-site scripting is one of the most dangerous website vulnerabilities. It is used in various ways to harm website users. Mostly it is used to perform session hijacking attacks. We also know that patching XSS is possible but we can never be 100% sure that no one can break our filter. Hackers always find ways to break filter security. If you really want to make a hard-to-crack XSS filter, study most of the available XSS vectors. Then make a list of the different kinds of attack pattern. Analyze the list and code the functions to identify an attack pattern and block the attack. I have also added few open source available libraries that you can use if you do not know how to patch the vulnerability and secure your website.
As a website owner or web developer, it is your responsibility to create a secure application that protects users’ data, so you must find and patch dangerous web application vulnerabilities.
Open Source Libraries for Preventing XSS Attacks
PHP AntiXSS
This is a nice PHP library that can help developers add an extra layer of protection from cross-site scripting vulnerabilities. It automatically detects the encoding of the data that must be filtered. Using of the library is easy. You can read more about it here: https://code.google.com/p/php-antixss/
xss_clean.php filter
This is a strong XSS filter that cleans various URF encodings and nested exploits. The developer built the function after analyzing the various sources. This coding of the function is available for free from github. See here: https://gist.github.com/mbijon/1098477
HTML Purifier
This is a standard HTML filtering library written in PHP. It removes all malicious code from the input and protects the website from XSS attack. It is also available as a plug-in for most PHP frameworks.
Read more about HTML Purifier here: http://htmlpurifier.org/
xssprotect
xssprotect is another nice library that gives developers a way to clean XSS attack vectors. This Library works by creating the HTML tag tree of the webpage. Then it parses the page and matches all tags. After that, it calls the filter interface to filter improper HTML attributes and XSS attacks. This library is written in Java.
Read more about this library here: https://code.google.com/p/xssprotect/
XSS HTML Filter
This is another XSS filter for Java. It is a simple single-class utility that can be used to properly sanitize user input against cross-site scripting and malicious HTML code injection.
Read more about this library here: http://finn-no.github.io/xss-html-fil...