Pro PHP Security: From Application Security Principles to the Implementation of XSS Defenses, Second Edition

Preventing XSS

Effective XSS prevention starts when the interface is being designed, not in the final testing stages or—even worse—after you discover the first exploit.

For example, applications that rely on form submission (POST requests) are much less vulnerable to attack than those that allow control via URI query strings (GET requests). It is important, then, before writing the first line of interface code, to set out a clear policy as to which actions and variables will be allowed as $_GET values, and which must come from $_POST values.

The design stage is also the best time to map out workflows within the application. A well-defined workflow allows the developer to set limits, for any given page, on what requests are expected next (discussed ...