URI::encode question

2 part answer:

 

 

I believe that URI::encode is meant to encode URI address strings, while most XSS exploits live in the body content. You don't see a lot of JavaScript URI exploits unless the app is written really badly. You can technically URI::encode anything though, including body content. But that job is usually better left to the application environment (i.e. PHP -> HTMLENTITIES()).

 

 

While URI::encode does provide some level of protection from the more mundane "" type exploits, I wouldn't rely on it solely to protect your site from XSS. Good coding practices, input validation, and white listing are your best bets against cross site scripting attacks.

 

 

Kevin