I would like to protect against  Cross site scripting (XSS),  in this publication:
Secure DotNetNuke Modules: http://www.dotnetnuke.com/LinkClick.aspx?fileticket=9jeLd9bVtzg%3D&tabid=940&mid=3268 

 It says:

"...the recommended practice is to utilize InputFilter with “NoMarkup”. If your input must allow HTML, then you can use “NoScripting” instead, but please think carefully whether or not your module really needs to support HTML text, as the “NoScripting” filter is a blacklist filter, and therefore like all blacklist filters may be fooled by carefully encoded content..."

What does this mean for end users and how can we protect against XSS attacks? Or know if a module is secure?
(I am running DNN v 4.9.3)

thanks,
mark.

thanks,

I have only used default DNN modules, but we have recently had an internet security check from a third party and have identified a critical security flaw with respect to the vendors page.

they said that:

"This location is vulnerable to embedded XSS.When creating a new vendor, arbitrary XSS
payloads could be placed in the following POST parameters:
dnn$ctr324$EditVendors$txtVendorName
dnn$ctr324$EditVendors$addresssVendor$txtTelephone
dnn$ctr324$EditVendors$addresssVendor$txtFax
dnn$ctr324$EditVendors$addresssVendor$txtStreet