This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Abridged XSS Prevention Cheat Sheet"

From OWASP
Jump to: navigation, search
(Created page with "= Introduction = The following table briefly describes how to defeat Cross Site Scripting in a variety of different contexts. = XSS Prevention = {| class="wikitable" |- ! Head...")
 
m (→‎XSS Prevention)
Line 7: Line 7:
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-
−
! Header 1
+
! Data Type
−
! Header 2
+
! Context
−
! Header 3
+
! Defense
 
|-
 
|-
−
| row 1, cell 1
+
| Numeric, Type safe language
−
| row 1, cell 2
+
| Any Context
−
| row 1, cell 3
+
| Cast to Numeric
 
|-
 
|-
−
| row 2, cell 1
+
| String
−
| row 2, cell 2
+
| HTML Body
−
| row 2, cell 3
+
| HTML Entity Encode
 
|-
 
|-
−
| row 3, cell 1
+
| String
−
| row 3, cell 2
+
| HTML Attribute, quoted
−
| row 3, cell 3
+
| HTML Entity Encode single and double quotes
 
|}
 
|}
−
 
  
 
= Related Articles =
 
= Related Articles =

Revision as of 01:37, 12 November 2011

Introduction

The following table briefly describes how to defeat Cross Site Scripting in a variety of different contexts.

XSS Prevention

Data Type Context Defense
Numeric, Type safe language Any Context Cast to Numeric
String HTML Body HTML Entity Encode
String HTML Attribute, quoted HTML Entity Encode single and double quotes

Related Articles

OWASP Cheat Sheets Project Homepage


V - T - E Cheat Sheets
Developer / Builder
Assessment / Breaker
Mobile
OpSec / Defender
Draft and Beta
All Pages In This Category

Authors and Primary Editors

Jim Manico - jim [at] owasp.org

Retrieved from "https://wiki.owasp.org/index.php?title=Abridged_XSS_Prevention_Cheat_Sheet&oldid=120027"