Google Online Security Blog: Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems
http://googleonlinesecurity.blogspot.com/2009/03/reducing-xss-by-way-of-automatic.html
Filtering & Escaping Cheat Sheet - Pixelated Dreams
http://pixelated-dreams.com/archives/231-Filtering-Escaping-Cheat-Sheet.html
Nice cheat sheet, but looking at the semi-random names of all these functions it's no wonder that this stuff isn't just natural.
Chris Shiflett: My Top Two PHP Security Practices
http://shiflett.org/blog/2005/feb/my-top-two-php-security-practices
"I have decided to promote my Top Two PHP Security Practices, expressed in four words: Filter input Escape output"
PHP: Filter Functions - Manual
http://us2.php.net/manual/en/ref.filter.php
"This extension serves to validate and filter data coming from some insecure source, such as user input."
Ned Batchelder: Xss with utf-7
http://www.nedbatchelder.com/blog/20070421T080434.html
"The resulting page doesn't have any explicit declaration of its character set, so depending on your browser settings, the browser may try to auto-detect the character set, and seeing the distinctive UTF-7 byte sequences, will choose UTF-7. In UTF-7, the
dtm: Most HTML templating languages are written incorrectly
http://dtm.livejournal.com/33960.html
"the problem with virtually every HTML templating language out there is that they make it easier for the person writing HTML templates to add an XSS hole than to avoid it."