-1

For example, websites that are built in ASP,PHP,Ruby?

Improve this question
3
  • 5
    That title melted my brain
    – Abe Miessler
    Dec 31, 2013 at 19:08
  • Can I ask why--?
    – Sky
    Dec 31, 2013 at 19:46
  • I think it was because you used some form of "different" three times within ten words.
    – Abe Miessler
    Dec 31, 2013 at 19:48

1 Answer 1

Reset to default
1

ASP.NET uses something called request validation to prevent stored (and possibly reflected?) XSS attacks. Request validation basically looks for malicious content when requests are submitted. If it finds any it will block the request.

By default request validation is enabled, but users can disable it.

It should be noted that request validation will not necessarily prevent DOM based XSS.

While many languages/frameworks may attempt to prevent XSS, it is never a substitute for secure code. The best defense is to understand the nature of the attack and write code with security in mind.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.