I've been reading about XSS prevention on OWASP and other security channels. They all say that I should use ESAPI or a similar library and do input filtering through a whitelist approach.
However, I use a framework (Webobjects) which encodes by default, so using ESAPI changes my input and is therefore not an option for me.
The second option is to use a whitelist approach. I support many languages like Japanese, Russian, Korean etc, so how do I decide what characters to whitelist?
Also, why is whitelist approach better than a blacklist approach as mentioned by OWASP? Why not just block a handfull of characters used in XSS like