Question

Is it enough to avoid javascript injection validating input data in such way:

xssValidate = function(value) {
    var container = $("<u></u>").text(value);
    if($(container).html() != value) return mc.ERROR_INVALID_FORMAT;
}

I’ve managed to validate all the text fields and textareas values with the code above before submit them to server.

Answer 1

I think that’s going to be very annoying for your users… what if I want to type “this & that” or “11 > 7”?

What you should be doing really is escaping it when you output it.

Additionally, I hope you’re validating on the server as well as the client side.