A survey on server-side approaches to securing web applications
Defeating script injection attacks with browser-enforced embedded policies