How to prevent XSS attacks

How to prevent XSS attacks，like this：

<img src="http://www.erorerer.com/a.jpg" onerror="alert(1)" />

<script>alert(1)</script>

[Gladskih]

@tuomassalo It’s really possible sanitaze stuff on the client before rendering.

[tuomassalo]

I’d like to amend @DmitrySkripkin’s comment, since it can be confusing and even dangerous for inexperienced developers.

Client-side modules can never prevent XSS attacks, even in theory. A malicious user can craft a http request that sends an XSS payload to the server, bypassing any client-side sanitation.

The correct way to prevent XSS attacks with rich-text editors is to enforce a whitelist of sanitation rules on the server, before storing the content. See #510 and eg. https://github.com/punkave/sanitize-html.