Recently I did a bit of digging around XSS and found that to prevent XSS the best way is to encode user input/output. Being a newbie in this field I am unable to get my head around this and have a couple of questions:
If on the server side we use a REGEX to strip of slashes
(/,\)and script opening/closing symbols
(<,>)can we prevent XSS?
I also came across an article wherein checkboxes and radio buttons were also being attacked by injecting an
onMouseHover = <script> .. </script>. Since this would not send any data back to server, how does this pose a threat?
Using firebug we can inject scripts almost everywhere. What exactly should we take care of? If user form inputs are properly validated are we good?