title: Is not displaying output enough to prevent link injection cross-site scripting?
body: <p>I'm new to dealing with cross-site scripting problems. We have some 404 pages that output the not found URL where, from what I learned, javascript can be maliciously substituted. To prevent an XSS attack, is it enough to simply remove the outputting of the bad URL? Or do I still need to somehow filter the input against a whitelist, for which I was looking at the OWASP library: <a href="https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API" rel="nofollow">https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API</a></p>