title: Java Best Practices to Prevent Cross Site Scripting
body: <p>I have gone through the OWASP top ten vulnerabilities and found that Cross-Site Scripting is the one we have to take notes. There was few way recommended solutions. One has stated that Do not use "blacklist" validation to detect XSS in input or to encode output. Searching for and replacing just a few characters (<code>&lt;</code> and <code>&gt;</code> and other similar characters or phrases such as <code>script</code>) is weak and has been attacked successfully. Even an unchecked <code>“&lt;b&gt;”</code> tag is unsafe in some contexts. XSS has a surprising number of variants that make it easy to bypass blacklist validation. Another solution said that Strong output encoding. Ensure that all user-supplied data is appropriately entity encoded (either HTML or XML depending on the output mechanism) before rendering. So, which is the best way to prevent cross site scripting to validate and replace the input or encoding the output ?</p>