我如何HTML编码Web应用程序中的所有输出？

Question

I want to prevent XSS attacks in my web application. I found that HTML Encoding the output can really prevent XSS attacks. Now the problem is that how do I HTML encode every single output in my application? I there a way to automate this?

I appreciate answers for JSP, ASP.net and PHP.

Answer 1

You don't want to encode all HTML, you only want to HTML-encode any user input that you're outputting.

For PHP: htmlentities and htmlspecialchars