Home > Ask the Security Experts > Information Security Threats Questions & Answers > To prevent cross-site scripting, should specific words and characters be rejected?
Ask The Security Expert: Questions & Answers
EMAIL THIS

To prevent cross-site scripting, should specific words and characters be rejected?

John Strand, featured expert EXPERT RESPONSE FROM: John Strand, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 14 September 2008
I'm interested in preventing cross-site scripting (XSS) attacks. If we reject characters and words like <, >, script, -- and their equivalent entity values, etc., that can cause malicious attacks -- it increases the cost of application development. Would you recommend this course of action?


BROWSE BY TAG
Information Security Threats,   Application and Platform Security,   Web Security Tools and Best Practices,   Web Application Security,   Application Attacks (Buffer Overflows, Cross-Site Scripting),   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Information Security Threats
How to get rid of malware, botnets on a hospital IT network
Should a national cybersecurity strategy include offensive botnets?
How can search results lead to malware?
How to prevent brute force webmail attacks
How to prevent mobile phone spying
What are today's antivirus software trends?
How to detect input validation errors and vulnerabilities
Can secure USB devices prevent man-in-the middle attacks
How to prevent and build protection against online identity theft
Is there a spy on my mobile device?

Web Application Security
Adobe patches ColdFusion vulnerability blocking website attack
nCircle statistics show rising Web application vulnerabilities
Twitter bugs, DNSSEC and broswer security
Month of Twitter Bugs project to document Twitter flaws
Are Web application penetration tests still important?
IT pros can detect, prevent website vulnerabilities, thwart attacks
PCI compliance requirement 6: Systems and applications
Trust eroding as social engineering attacks climb in 2009, says Kaspersky expert
US-CERT warns of Gumblar, Martuz drive-by exploits
XSS bugs, information leakage top list of website vulnerabilities

Application Attacks (Buffer Overflows, Cross-Site Scripting)
Adobe ColdFusion websites being compromised
PCI management: The case for Web application firewalls
Month of Twitter Bugs project to document Twitter flaws
Adobe issues first quarterly patch release fixing 13 flaws
Balancing security and performance: Protecting layer 7 on the network
Adobe issues Reader update fixing zero-day flaw
The Pipe Dream of No More Free Bugs
Security Squad: Federal cybersecurity defenses
Oracle issues 43 updates, fixes serious database flaws
Attackers target new Microsoft PowerPoint zero-day flaw
Application Attacks (Buffer Overflows, Cross-Site Scripting) Research

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
anonymous Web surfing  (SearchSecurity.com)
buffer overflow  (SearchSecurity.com)
cache cramming  (SearchSecurity.com)
cookie poisoning  (SearchSecurity.com)
dictionary attack  (SearchSecurity.com)
distributed denial-of-service attack  (SearchSecurity.com)
JavaScript hijacking  (SearchSecurity.com)
National Computer Security Center  (SearchSecurity.com)
threat modeling  (SearchSecurity.com)
trigraph  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


No. Instead, I recommend that developers code their applications to only allow the required set of characters necessary for the application to function properly. That is an application development best practice.

Many organizations view secure coding as an activity that is supposed to happen at the end of the development process. However, if someone testing an application at the end of the development lifecycle says an application needs recoding to ensure its security, that application will need to be reworked and retested, along with any other application that interacts with it. This constant tweaking is often far more expensive than implementing an iterative security process throughout an application development lifecycle.

If there is a field called "State," for example, there is no reason to allow <, > ;, *, --, or : as possible values. If application developers write code from the perspective of only accepting known good values, it decreases the overall cost of application development by cutting quality assurance and certification and accreditation testing.

For more help, a great framework to use is the Scalable & Agile Lifecycle Security for Applications.

More information:

  • Video: Security researchers at Information Security Decisions 2008 recently discussed how to keep enterprises safe from cross-site scripting and buffer overflows.




  • Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    Targeted Security Channel Tips for Resellers, Integrators and Consultants
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts