Simon Willison’s Weblog

OWASP: XSS Prevention Cheat Sheet. Comprehensive set of rules for avoiding XSS—there’s a bit more to it than just escaping all output variables, since you have to take markup context in to account.

Posted 24th January 2009 at 11:58 pm

Recent articles

Vibe engineering - 7th October 2025
OpenAI DevDay 2025 live blog - 6th October 2025
Embracing the parallel coding agent lifestyle - 5th October 2025

markup 8 owasp 4 security 551 xss 60

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe