Reply to thread

We provide all the tools for a developer to write code safely by way of a well written and security-minded framework. Using the standard framework functions for such things as AJAX requests, this is a non-issue.

Just like using the standard approaches to escaping user generated content, input and writing database queries.

Despite those features, we can’t totally prevent people deviating from them and creating XSS or SQL injection vectors in the process.

So it really is, like anything else, just a case of continuing to set a good example in our own code and if there are any add ons which can be exploited by this issue (which frankly I think will be very few to none) then they should be contacted on a per case basis.