I've got a function in my app where users can click on a "thumbs up" image and a like is recorded in the database; all that's recorded is the user's ID and the ID of the post that the user liked.
I know user input can't be trusted--am sanitizing user inputs, validating user inputs (server-side), escaping outputs, and escaping db queries.
In this case, the user is clicking the image, but there is no form. However, data is being passed to the database, using JS. Note, there is no user input between any script tags (the like script is on a page that isn't served).
My plan is to validate (server-side) that only numbers are being sent to the database, but how do I sanitize this "like"/thumbs up input to protect against XSS?
Note: I'm currently reading through OWASP's XSS Prevention Cheat Sheet and Mozilla's Secure Coding Guidelines, which is how I started wondering about this.