== XSS Defense Resources

=== Java OWASP Encoder
Do not be bothered by the incubator status on this project, use it if you are doing Java Web Apps and want to defend against XSS, use this
link: https://www.owasp.org/index.php/OWASP_Java_Encoder_Project

=== General XSS prevention Cheat Sheet
link: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

=== DOM XSS Prevention Cheat Sheet
link: https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet

=== XSS Filter Evasion
Good to know your enemy ...
link https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

=== Javascript Framework Specifics

Encoding in the client can be tricky. Here are somre resources to help with that. If you don't see your framework below (e.g. Ember, React, ???) and would like to contribute or suggest something ...
stop by https://github.com/WebGoat/WebGoat and file an issue (preferably with some recommendations/links) or fork and submit a PR.

==== jQuery
be aware if you are using something like ...

_$selector.html(userInputHere)_,

...you are in danger. If you want to use that, ensure you are doing someting more like:

_$selector.html(someEncodeHtmlMethod(userInputHere))_

OR

_$selector.*text*(someEncodeHtmlMethod(userInputHere))_

...if you only want the text of what is output by the user (http://stackoverflow.com/questions/9735045/is-jquery-text-method-xss-safe#9735118)

==== Backbone.js
(One character can make such a difference)

http://underscorejs.org/#template

https://nvisium.com/blog/2015/05/21/dont-break-your-backbone-xss-mitigation/

==== Angular
Angular has sought to escape by default, but the expression language has proven to have 'sandbox' escapes.  Best to check
details of the version you are using and consult starting here: https://docs.angularjs.org/guide/security