As a blanket approach to dealing with XSS attacks, rather than having to remember to escape user-generated code, is there a way to instruct the browser not to execute any script or script-function which isn't signed with a particular public key (embedded in the top of every page, but not necessarily authenticated. This is only meant for dealing with XSS, not man-in-the-middle)? Then you could just sign all the "real" scripts
This would be a real hit to performance. Imagine you have a ton of embedded functions within your HTML page. Each would need to be signed seperately. Furthermore your server side code needs to be able to access your keystore to sign the code as often pages are generated dynamically. This would mean a substantial overhead to be dealt with.
Anyway most of this can be fixed with CSP anyway.