将不受信任的数据传递到Javascript脚本的不同方法？

Question

I have a Javascript function that retrieves data from the form onClick via the submission button.

 function valueCheck()
 {
            var cCheck = document.getElementById("c");
            var cChoice = chemCheck.options[chemCheck.selectedIndex].value;

            var coCheck = document.getElementById("co");
            var coChoice = compCheck.options[compCheck.selectedIndex].value;

            var gCheck = document.getElementById("g");
            var gChoice = geoCheck.options[geoCheck.selectedIndex].value;

            var mCheck = document.getElementById("m");
            var mChoice = mathCheck.options[mathCheck.selectedIndex].value;

            var pCheck = document.getElementById("p");
            var pChoice = physCheck.options[physCheck.selectedIndex].value;

According to OSWAP XSS PREVENTION CHEAT SHEET this is unsafe. The data is 'sanitized' using filter_var($var, FILTER_SANITIZE_STRING) and I trim() it as well for good measure. Unfortunately, this is server-side so it doesn't help. Right now there is a vulnerability if someone were to change the values in the select menu. I call my Javascript function like so:

<input type="submit" name="submit" onClick="return function();">

It needs to be able to work client-side. How can I filter/sanitize the data before I pass it to my Javascript function? I need to get each value in the select boxes so I can make sure they aren't the same. (Note the whole function isn't shown above, I can provide it if needed. I think the issue is mainly the way I put the data into the script).

How can I escape the data?

EDIT: To clarify my question, I am wondering if there is a secure method to passing client-side data to a javascript function. This data hasn't been sanitized yet (besides all the client-side stuff I can do to it) so I'm worried that there may be an XSS vulnerability. According to the OSWAP XSS Prevention Cheat Sheet I'm supposed to escape data, but I am not too sure how to do this as well. I do not render any user-inputted data into the browser, it is only stored.

EDIT2: I think I finally understand. The XSS vulnerabilities mentioned in the OSWAP cheatsheet refer to placing user-given data into HTML/other things and displaying it back to the page? If I'm only saving this to text files/csv files I think I'd just have to make sure everything is good server-side.

Answer 1

If you only store data, there is no XSS vulnerability. End of strory. However, you should still check input data length if you don't want someone to put 10TB of data into your server.

Generally client-side is an illusion. HTML and JavaScript are like curtain that covers real code of your webapp (php or whatever you got on server side). You can never trust client side data, even if you filter it with JS. Someone can basically turn off JS or use some other software than browser to comunicate with your website (like netcat or curl).

I recommend you to watch this whole movie so you can imagine way hackers will hack you.

Remember, filter input/output data server side .