javascriptxsssanitizationhtml-sanitizing

XSS - It is possible to sanitise user input by removing "<"?

On the front-end is it possible to catch all XSS attacks by removing < from user content? This seems a simple way to disable malicious code, and currently I have no use-cases that would require < to be preserved. Will this work in all cases?

The way I would display user content would always be as inner html, e.g.

<div>{USER CONTENT}</div>
Solution

  • Depends where you use the user input.

    If you use it inside a a href=, then well: no!

    <a href="{{linkFromUser}}">

    and then that could be javascript:alert('oh no');

    and a browser will execute it if the link is pressed, in the context of your page.