Your question shows a misguided understanding of XSS.
It is important for you to understand the basic mechanism of the exploit. User input data (from URL, cookies, post data, Etc. Can enter the program and thereafter be used to attack your users, your server or your business.
You need to identify every place where this input data appears, and subject it to a check such as a character whitelist (eg regex match). This will prevent injection flaws of any type, including XSS.
Further, you ADDITIONALLY have to ensure that any data printed out that is not generated by your own developers (including perhaps a site administrator in your case) is encoded appropriately for its context. E.g. replacing < with < in html entities, and other encoding/escaping as appropriate for attributes, JavaScript, JSON etc.
The last part is when a subset of html or JavaScript is allowed as a user input (for example if you allow <B> but not <script> ). In this case you need to transform all input thusly:
- Transforming < to < etc.
- And then transform the whitelisted sequences back, e.g <B> back to <B> and so forth.
In my example I show “whitelisted” html tags but you will have to similarly whitelist JavaScript. You have to go a bit further, understanding exactly which JavaScript could be allowed and run that through a parser to identify the parts that can he allowed in user input.
I hope you find this helpful. I am an application security expert with ten years’ experience.