Search code examples
javascriptxss

Is it enough to avoid xss?


When user put <script>alert('Hello');</script> on my site ie on comments section its translated: <script>alert('Hello');</script> is it enough to avoid xss attack on my site?


Solution

  • If you convert every < to &lt; and every > to &gt;, it will prevent the user to enter any html tag. So it is enough.