A penetration tester finds that a website is vulnerable to c…
A penetration tester finds that a website is vulnerable to cross site scripting by generating XSS popup boxes in many locations within the app. The website developer implements a pattern-matching denylist that searches for input that includes “script” followed by “alert”. What is the issue with the developer’s solution? What would you suggest for XSS protection?