title: Which XSS OWASP Rule
body: <p>Using the OWASP checklist, which is the correct way protect this situation?  This is url inside of a javascript string where a url parameter needs to have xss protection.</p>
  
  <p>Problem:  </p>
  
  <pre><code>&lt;script&gt;
      var u = 'xyz.html?x=&lt;% url.baddata %&gt;'  
      dosomeAjax(u);
  &lt;/script&gt;
  </code></pre>
  
  <p>Possible solution 1:   </p>
  
  <pre><code>var u = 'xyz.html?x=&lt;% encodeForURL(url.baddata) %&gt;'
  </code></pre>
  
  <p>Possible solution 2:   </p>
  
  <pre><code>var u = 'xyz.html?x=&lt;% encodeForJavaScript(url.baddata) %&gt;'  
  </code></pre>
  
  <p>Possible solution 3:   </p>
  
  <pre><code>var u = 'xyz.html?x=&lt;% encodeForJavaScript(encodeForURL(url.baddata)) %&gt;'  
  </code></pre>