XSS Defense Chapter

Last week asked to write in any language to write a message version, stored in the database, with their own way to solve the XSS

I used Jsp+mysql to write a filter to protect against web XSS vulnerabilities.

1  PackageCom.mess.filter;2 3  Public classHtmlfilter {4      Public Staticstring Filter (string html) {5         if(html = =NULL) {6             return NULL;7         }8StringBuilder SB =NewStringBuilder (Html.length ());9          for(inti = 0; I < html.length (); i++) {Ten             Charc =Html.charat (i); One             Switch(c) { A              Case' > ': -Sb.append ("&gt;"); -                  Break; the              Case' < ': -Sb.append ("&lt;"); -                  Break; -              Case' & ': +Sb.append ("&amp;"); -                  Break; +              Case‘"‘: ASb.append ("&quit;"); at                  Break; -              Case‘\‘‘: -Sb.append ("& #039;"); -                  Break; -             default: - Sb.append (c); in                  Break; -             } to         } +         returnsb.tostring (); -     } the  *       $ Panax Notoginseng}

String title = Htmlfilter.filter (Request.getparameter ("title"));
String content = Htmlfilter.filter (request.getparameter ("content"));

Encode it before you join the database. Although XSS forms a variety, it is difficult to defend. But this is basically enough for small and medium companies.

If you don't feel enough, you can refer to using owasp Esapi, not only to protect against XSS, but also to protect against common web vulnerabilities such as SQL.

XSS Defense Chapter