title: Secure Node.js chat (avoid XSS)
body: <p>I'm building a simple little chat with Node.js and socket.io</p>
  
  <p>When a user types his message, it is broadcasted to all other users.</p>
  
  <p>Server sends the message :</p>
  
  <pre><code>io.sockets.emit('fromServerToClient', { "message": message });
  </code></pre>
  
  <p>Client displays it :</p>
  
  <pre><code>socket.on('fromServerToClient', function (data) {
      $('#messages').append(data.message + '&lt;br /&gt;');
  });
  </code></pre>
  
  <p>But when you send something like <code>&lt;script&gt;alert(1);&lt;/script&gt;</code>, it is executed on every client browser.</p>
  
  <p>This is a serious security flaw and I want to avoid it as much as possible.
  I've seen people escape <code>&amp;, &lt;, &gt; and "</code> characters, but I don't think it's enough!</p>
  
  <p>How can I be 100% sure of not having a XSS vulnerability on my chat?</p>
  
  <p>By the way, I always specify the charset to avoid UTF-7 attacks.</p>
  
  <p>Thanks for your help.</p>