White List encoding prevents XSS

WoYiGuis BLoG

In the AntiXSS project, each function is encoded in the whitelist mode. For example, an EncodeHtml () Java function:

Private static String EncodeHtml (String strInput ){
If (strInput. length () = 0 ){
Return EmptyString;
}
StringBuffer builder = new StringBuffer (strInput. length () * 2 );
CharacterIterator it = new StringCharacterIterator (strInput );
For (char ch = it. first (); ch! = CharacterIterator. DONE; ch = it. next ()){
If (ch> ') & (ch <{) | (ch >@) & (ch <[)))
| (Ch =) | (ch>/) & (ch <:)) | (ch = .) | (ch =,) | (ch =-) | (ch = _))))){
Builder. append (ch );
} Else {
Builder. append ("& #" + (int) ch + ";");
}
}
Return builder. toString ();
}
According to ASCII, the characters that are normally used are excluded and all other characters are encoded. It is much better than other self-writing functions using blacklist encoding ..