3 votes
Accepted

How to sanitize $_SERVER url variables?

This approach doesn't make sense. Cross-site scripting is an output problem, not an input problem. The vulnerability consists of inserting a string (which currently happens to be the referrer header) ...
Ja1024's user avatar
  • 5,917
2 votes

Secure way to output encoding HTML for insert raw html via javascript

If you want to insert untrusted HTML markup as text, then you should use the textContent property, not innerHTML. The textContent property reliably prevents XSS attacks, because the content is only ...
Ja1024's user avatar
  • 5,917

Only top scored, non community-wiki answers of a minimum length are eligible