I have been studying to prevent my web app against XSS.
I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through whitelist approach.
However, I use a framework, which by default encodes (Webobjects), so using ESAPI changes my input , and this option is not for me.
The second option, using whitelist approach. I support many languages like japanese, russian, korean etc, so how do I decide a whitelist approach ?
Also, why is whitelist approach better than blacklist approach as mentioned by OWASP. Why not just block a handfull of characters used in XSS like < , > , etc