Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • atk, <br/> since the payload in request is already encoded by the attacker, encoding it to Unicode/Utf-8 on the server side is not helping. Commented Jun 2, 2014 at 11:17
  • @AshishK, again, the server is only reaponsible for encoding the output it is writing. It is not writing HTML output. It is writing XML output. As such, the server is *only responsible for XML encoding. Commented Jun 2, 2014 at 11:48
  • atk, are you suggesting I encode the response? I can't find any difference between Html Encoding and Xml Encoding. Commented Jun 2, 2014 at 12:18
  • I am suggesting you encode independently in each location that writes output. You are correct that html encoding is the same as xml encoding - html is, in fact, an xml-based specification. When you only encode xml, you only decode for xml. If you want to encode for html, encode when you write the html and don't rely on prior encoding to do it for you. As you found, it doesn't. Commented Jun 2, 2014 at 22:20
  • Oh, also, use numeric entities and encode everything that is not alphanumeric. This will prevent many attack vectors that you haven't addressed yet Commented Jun 2, 2014 at 22:24