EncodeUri Function in JavaScript

Question

I am generating a search output based on a user query and generating search result pages like this

location.href = root_url + "SearchCenter/Pages/internal.aspx" + "?q=" + st

I am looking into protecting against XSS attacks.

I am using encodeURI to protect against the attack with

encodeURI("http://Server.com/SearchCenter/Pages/internal.aspx?q=<script>alert('dd')</script>)" 

which outputs

http://server.com/SearchCenter/Pages/internal.aspx?q=%3Cscript%3Ealert('dd')%3C/script%3E)

Now what if instead of tag they enter JavaScript:Alert('dd') which encodeURI would not protect against.

So my question is that is there any JS library or function that I can use to protect against URL XSS attacks.

Answer 1

You should solve this server side. Never trust the client so whatever it sends should be vetted on the server before being rendered in the HTML. So accept whatever they send and use a server component to make sure that whatever gets outputted is safe.