Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For example, websites that are built in ASP,PHP,Ruby?

share|improve this question

closed as too broad by Xander, TildalWave, Adnan, AviD Jan 1 at 0:32

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

5  
That title melted my brain –  Abe Miessler Dec 31 '13 at 19:08
    
Can I ask why--? –  Sky Dec 31 '13 at 19:46
    
I think it was because you used some form of "different" three times within ten words. –  Abe Miessler Dec 31 '13 at 19:48

1 Answer 1

ASP.NET uses something called request validation to prevent stored (and possibly reflected?) XSS attacks. Request validation basically looks for malicious content when requests are submitted. If it finds any it will block the request.

By default request validation is enabled, but users can disable it.

It should be noted that request validation will not necessarily prevent DOM based XSS.

While many languages/frameworks may attempt to prevent XSS, it is never a substitute for secure code. The best defense is to understand the nature of the attack and write code with security in mind.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.