XSS input validation

[Eric Soucy, módosítva 9 év-val korábban]

Hello,
What would be the best way to prevent xss attack by validating/rejecting dangerous input data in my portlet?
I want to prevent invalid form input from being saved in my database on a form submit (post).
I am using JSF for my portlets.

Thank you

[Samuel Kong, módosítva 9 év-val korábban]

There are several APIs that Liferay provides for this. Check out Validator, HtmlUtil, and SanitizerUtil. If you're going to use the last one, make sure you deploy the AntiSamy hook (or implement your own sanitizer).

[Kyle Joseph Stiemann, módosítva 9 év-val korábban]

Hi Eric,
I recommend reading BalusC's StackOverflow answer on JSF security.

- Kyle