Argh, this is at least the second XSS vulnerability that’s been found in Skype in the last few months.

> skype.com has to validate the input characters and sanitize the output

I don’t like this solution. It mostly works for the phone number field, but not for other fields. (I want my status to be “<script>alert('XSS!')</script>”, damnit!)

The right solution is to make sure that when data gets inserted into code, it’s encoded. If you’re inserting text into an HTML document, run it through an HTML encoder. If you’re inserting text into an SQL statement, run it through an SQL encoder.

Or, use something that distinguishes between code and data, like an HTML templating system or parametrized queries.