I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques.
My question is- why don't we store what ever is going to server as parameters and if these parameters are reflected in HTML response then discard it or encoded it. Simple idea. I feel there may be false positives but not very convincing ones. Any input?