XSS check is too aggressive? about validator.js

[chriso]

Rule #1 = you can never be too careful :)

While the things you've listed will stop 99% of cases, there's certain circumstances where attacks will still pass through.

Example: if you don't explicitly specify the charset when sending a page to IE, it attempts to determine the charset. A hacker could fool the browser into thinking the page is a strange charset, like UTF-7. The following XSS attack will be able to get through the filters you listed: +ADw-script+AD4-alert(document.location)+ADw-/script+AD4-

This is one of many obscure attack vectors. Google "XSS attack" for some more info.

If anything, the method I provide isn't enough!