Web Security · Junior · Question 27 of 75
Which approach to blocking XSS is the most reliable?
- 1Allow only input shorter than 100 characters
- ✓Correct answer: Encode output by context and sanitize HTML with a proven library
- 3Remove the word
scriptfrom all user input
Explanation
Blocklists are easy to bypass: <img onerror>, <svg onload> and encoding tricks don't contain <script>. Contextual encoding works no matter what the input is.