URI encode and HTML encode

Question

If I have the xml/html data to post we need to encode the data to avoid the XSS validation. So should we use HTMLencode or URI encoding for this.

If URI encoding is used will it cause issues as form POST automatically URI encode all the data before sending.

Answer 1

XSS is a problem caused by giving tainted data to the client. It can't be solved at the point where data is posted.

To protect against it, HTML encode the data (immediately) before placing it in an HTML document.

Answer 2

Remember: filter input, escape output .

1. Always filter input before placing it in a database (to avoid SQL injection etc)
2. Escape output before sending it to the client by filtering / encoding any HTML in the dynamic content.