On my site, if I were to block
<script> from the url, could this prevent some cases of XSS? Any way someone could bypass that?
Yes, it can be bypassed. First, many filters that attempt to remove
<script> tags do so in a way that is easily defeated. For example, they may improperly handle input like
But even when implemented "properly", that is not sufficient, because