I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like
<script>alert("hi")</script> is input to form fields.
So, i have currently employed technique of URL rewriting in apache web server to solve this issue.
I dont know enough about XSS.
I want to know from experts here, is this is the right approach to solve XSS when the input to form fields is not showing vulnerability ?