Avoiding XSS vulnerabilities - whitelist?

Question

What are the best practices to prevent XSS vulnerabilities?

A lot of people on here have mentioned whitelists which sounds like a good idea, but I see many people define the whitelist using a RegEx. This seems inherently flawed because it depends on many factors, the least of which is the RegEx implementation and the skill of the person writing the expression not to make a mistake. Consequently a lot of XSS attacks succeed because they use techniques to make the regex accept them.

What are the best (though maybe more labor intensive than regex whitelist) ways to avoid these vulnerabilities/sanitize user input? Is it even theoretically possible to fully sanitize user input?

Answer 1

Have a look at AntiXSS library.