Is sanitizing html by removing angle brackets safe?

Question

I want to sanitize a simple text field with a person's name, to protect from XSS and such. Stackoverflow pretty much says I must whitelist. I don't understand this. If I simply remove all < and > from the input value, or replace them with > and &ls;, does not that rule out code injection? Or am I missing something? Perhaps you only need to whitelist in more complex scenarios where you have to put up with angular brackets?

Sorry if it's a silly question, it's important to get this right.

Answer 1

Whether to whitelist or encode depends on how you want to use the text.

If you intend to treat the input as plain text, then encoding special characters is enough, and any HTML code entered will display as text only as long as you are careful not to allow unencoded text to end up anywhere in your HTML output. (This includes making sure any other systems you interface with don’t inappropriately use the unencoded text.)

If you want to allow some markup in the input, such as text styling or links, then you must whitelist the tags that you allow and get rid of all others.