How to prevent XSS attacks ?

[rthangam]

I have my own website which runs on mod_perl. I need to prevent my
website from XSS ( Cross-site scripting ) attacks. Can anyone tell me
which is the best way of doing it ?. I found the following links to
handle it:

http://www.howtoforge.com/apache_mod_security
http://search.cpan.org/~lindner/Apache-TaintRequest-0.10/TaintRequest.pm

Which of these is better also is there any other ways to handle the
XSS attacks?.

 

[Tim Greer]

I have my own website which runs on mod_perl. I need to prevent my
website from XSS ( Cross-site scripting ) attacks. Can anyone tell me
which is the best way of doing it ?. I found the following links to
handle it:

http://www.howtoforge.com/apache_mod_security
http://search.cpan.org/~lindner/Apache-TaintRequest-0.10/TaintRequest.pm

Which of these is better also is there any other ways to handle the
XSS attacks?.

If you don't write code that opens that potential, you needn't worry
about using things like mod_security. That's just a way to stop
attacks on vulnerable scripts before it hits the script, which is
backward thinking for resolving a problem (if you control the script).
Exactly what things are you doing (and how are you going about doing
them) where you're introducing the potential for an XSS attack issue?

 

[rthangam]

If you don't write code that opens that potential, you needn't worry
about using things like mod_security.  That's just a way to stop
attacks on vulnerable scripts before it hits the script, which is
backward thinking for resolving a problem (if you control the script).
Exactly what things are you doing (and how are you going about doing
them) where you're introducing the potential for an XSS attack issue?
--
Tim Greer, CEO/Founder/CTO, BurlyHost.com, Inc.
Shared Hosting, Reseller Hosting, Dedicated & Semi-Dedicated servers
and Custom Hosting.  24/7 support, 30 day guarantee, secure servers.
Industry's most experienced staff! -- Web Hosting With Muscle!

Right now it is possible to tamper the URL since I am not encoding and
decoding the URL.
Will the problem get solved if i encode and decode the URL ?