避免xss是否足够？

Question

当用户将<script>alert('Hello');</script>放在我的网站上，即评论部分时，其翻译为：<script> alert（'Hello'）; </ script>是否足以避免对我的xss攻击现场？

Answer 1

If you convert every < to < and every > to > , it will prevent the user to enter any html tag. So it is enough.

Answer 2

Have a look on these Examples too for better security of your website:

1. Best Possible Security for Reflected XSS :

<?php 

// Is there any input? 
if( array_key_exists( "name", $_GET ) && $_GET[ 'name' ] !=     NULL ) { 
// Check Anti-CSRF token 
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 

// Get input 
$name = htmlspecialchars( $_GET[ 'name' ] ); 

// Feedback for end user 
echo "<pre>Hello ${name}</pre>"; 
} 

// Generate Anti-CSRF token 
generateSessionToken(); 

?> 

2. Best Possible Security for Stored XSS :

<?php 

if( isset( $_POST[ 'btnSign' ] ) ) { 
// Check Anti-CSRF token 
checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' ); 

// Get input 
$message = trim( $_POST[ 'mtxMessage' ] ); 
$name    = trim( $_POST[ 'txtName' ] ); 

// Sanitize message input 
$message = stripslashes( $message ); 
$message = mysql_real_escape_string( $message ); 
$message = htmlspecialchars( $message ); 

// Sanitize name input 
$name = stripslashes( $name ); 
$name = mysql_real_escape_string( $name ); 
$name = htmlspecialchars( $name ); 

// Update database 
$data = $db->prepare( 'INSERT INTO guestbook ( comment, name ) VALUES ( :message, :name );' ); 
$data->bindParam( ':message', $message, PDO::PARAM_STR ); 
$data->bindParam( ':name', $name, PDO::PARAM_STR ); 
$data->execute(); 
} 

// Generate Anti-CSRF token 
generateSessionToken(); 

?>