Multiple choice technology security

What is the best way to mitigate a Cross Site Scripting while enabling the special characters such as javascript tags to be displayed on the web browser without actually being executed?

  1. URL/HTML encoding

  2. Blacklisting

  3. Whitelisting

  4. Parameterized SQL queries in application code/configuration
Reveal answer Fill a bubble to check yourself
A Correct answer
Explanation

Cross-Site Scripting (XSS) occurs when untrusted data is executed as code. To display special characters like tags safely without execution, you must HTML-encode them - converting < to &lt;, > to &gt;, etc. This renders the characters visually but they're not parsed as HTML/JavaScript. Option A (URL/HTML encoding) is correct. Blacklisting (B) is unreliable, whitelisting (C) doesn't solve display, and parameterized SQL (D) prevents SQL injection, not XSS.

Keep practicing — related questions