Why blacklists fail

An analogy: a bouncer with a list of faces

A bouncer with a list of ten banned faces stops those ten people. Anyone not on the list walks in, including the eleventh troublemaker, and an honest guest who happens to look like someone on the list gets turned away. Escaping is a different idea entirely: everybody gets in, but nobody gets to go backstage.

Our toy filter

For this lab we wrote a deliberately simple filter in watched.leg3c_toypages. It only deletes the exact text <script> and </script>:

def toy_filter(text):
    return text.replace("<script>", "").replace("</script>", "")

def filtered_comment(text):
    return '<p class="comment">' + toy_filter(text) + "</p>"

Here are the four cases in FILTER_CASES, run through it:

What each row teaches:

• Row 1: the filter catches the one thing it was written for. This is why filters look like they work in a quick test.
• Row 2: HTML tag names ignore letter case, but our filter does not. One missed variation is enough.
• Row 3: script does not need a <script> tag at all. Event-handler attributes run script too, and there are many of them.
• Row 4: an honest visitor writing about HTML had their words eaten. Filters hurt real users.

You could patch the filter for each row. Then there would be a fifth case, and a sixth. The list of things HTML can do is long and keeps growing, so a filter is always one step behind. That race is not one to enter; this course does not go further into it.

The fix: escape, do not filter

Escaping does not need a list of bad things. It changes the five special characters, so nothing typed can become a tag or an attribute. Every row above becomes: script ran No, text kept Yes. Honest text survives because nothing is deleted.

The lab

Write escaped_comment(text), and compare(cases), which measures both approaches on a list of cases and returns one dict per case.

A common misconception

"Filters are fine as a second layer." Defence in depth is good, but the second layer should be something designed for it, such as the Content Security Policy in the next module (Lesson 64), not a word list that also breaks honest text. Allow-lists have their place for structure ("this field is a number", "links must start with https://") or for rich text through a well-tested sanitiser library. They do not replace escaping.

Want to go deeper? PortSwigger's free Web Security Academy has a full XSS track with its own practice labs, built for learning safely.

// toy filter (bad idea)
const toyFilter = (t) => t.replaceAll("<script>", "").replaceAll("</script>", "");
el.innerHTML = toyFilter(comment);       // still runs <img onerror>

// the fix
el.textContent = comment;                // nothing typed becomes markup

// Go: html/template escapes for you; never build HTML with string glue
tmpl := template.Must(template.New("c").Parse(`<p class="comment">{{.}}</p>`))
tmpl.Execute(w, comment)