The data that is inserted into your Web pages should filter out byte sequences that are considered special based on the specific character set. You must take into account localization issues when you change these parameters. This technique is effective on data that was not validated for some reason during input. If you encode the HTML and URLs, you may need to specify the code page as you would if you were to filter data. Filtering input works by removing some or all special characters from your input.
Special characters are characters that enable script to be generated within an HTML stream.
Filtering may not be appropriate for some input. Some filtered characters may actually be required input to server-side script. This technique is similar to filtering input except that you filter characters that are written out to the client. While this can be an effective technique, it may present a problem for Web pages that write out HTML elements. Therefore, in order for this technique to be useful, you would only filter data passed in or data that was previously entered by a user and stored in a database.