I recently joined a company with a million+ lines-of-code PHP app. The security approach to XSS appears to be to filter output whenever the dev thought of it. Not surprisingly, they didn't catch everything, and we've got some real doozy XSS opportunities.
In a past life I've used the approach Rasmus advocates:
filter all input to be XSS safe, and don't sweat it on display. This approach worked well: most data works perfectly most of the time, and code that uses
filter(UNSAFE_RAW) isn't exactly forbidden but it sure gets extra attention in code reviews.
The problem I'm having is: How do you migrate from one approach to the other? Seems like now I'm going to have to encode all the contents of the database and play whack-a-mole to remove all the new double-encode bugs I'll discover. (It should be a little easier since I can grep for the existence of
htmlspecialchars() but I can't grep for its absence. :) )
A really useful answer might be a blog about a successful project or even a post-mortem.