javascript - Mitigating XSS attacks from submitted data - is the < character the heart of all attacks? -

i have been perusing owasp xss filter evasion cheat sheet , appears (all?) user-input based xss attack vectors depend on ability submit < character or encoded version thereof. per owasp document, can't find attack vectors bypass need inject < character in way. if input filter checks , removes or replaces instances of < user-submitted data, xss risks mitigated?

specifically i'm asking if there other xss attack vectors against user-submitted data don't depend on < character.

obviously doesn't mitigate sql injection etc, that's separate issue.

thanks input!

i not going does prevent, address of allows through.

let's filter takes string, , returns string of < replaced empty strings. ignoring mess implementation if not careful. if inject un-trusted data html attributes or javascript strings, example, you've done nothing mitigate xss.

here's example of xss attack vector use bypass filterleftbrackets():

<div id="content" data-query="~injection-point~"></div> 

payload be: q" onmouseover=alert('xss'); data-x="

resulting in:

<div id="content" data-query="q" onmouseover=alert('xss'); data-x=""></div> 

here's 1 javascript:

var querymsg = "you searched for: " + "~injection-point~"; 

payload be: q"; alert('xss'); var x="

resulting in:

var querymsg = "you searched for: " + "q"; alert('xss'); var x=""; 

in both cases, needed escape ", have been '. thing injection depends entirely on context. thoughtful putting user input, , check have been used "break out" of constraints assume set.

in short, use library... don't come own scheme, , thoughtful of context.

---

please note evasion cheat sheet:

this cheat sheet people already understand basics of xss attacks want deep understanding of nuances regarding filter evasion.

you may find more helpful: https://www.owasp.org/index.php/xss_(cross_site_scripting)_prevention_cheat_sheet

i'm big fan of tutorial google: https://www.google.com/about/appsecurity/learning/xss/