跨网站脚本攻击的防护是一个及其复杂的问题。随着用户生成内容在互联网上日渐流行,许多网站也越来越多地允许用户用HTML代码来为自己量身裁剪内容,如自己博客上的评论或者社交网站公告等等。但这也为一种被称作跨网站脚本攻击的危险方式敞开了门户,这种攻击可以使攻击者通过可信任网站盗取用户的信息。日前,在加州奥克兰举行的IEEE安 Protection against cross-site scripting attacks is a complex one. As user-generated content is becoming more prevalent on the Internet, many websites are also increasingly allowing users to tailor their content with HTML code, such as comments on their own blog or social networking site announcements. But it also opens the door to a dangerous way of attack known as cross-site scripting, which can allow an attacker to steal a user’s information through a trusted website. A few days ago, held in Oakland, California, IEEE