First, I need to make sure you all know about what is Cross-site scripting

http://en.wikipedia.org/wiki/Cross-site_scripting

After that, you may know that FCKeditor only allows users to enter content. The same can be achieved by used a simple textbox.

The main idea of cross-site scripting is that anyone could use your input control to enter script code that can be used for other purposes than the required ones.

As I told you before, it does not matter if you are using a Rich Text control or a simple textbox, the content can always include some kind of scripting.

After the content is entered, a program (A module in our case) running at the server is the one that processes this content to store it or to show it again when requested. So this program or module is the one responsible for checking and cleaning  the malware.

Please take note that this could happen even if you are using other controls than rich text editors. By reading the xfore post, you must take care to read the "COULD" word.

I think the only way to be really out of being cross-scripted is to don't allow any content from external users.....but....maybe me and other prefer to receive external content.

DotNetNuke has made a lot of work to reduce the cross-scripting attacks as well as possible sql-injection attacks. I will ask Cathal to post to this thread to clarify a little more about it.

As the last comment for this post, I will say that ISS also manages my own firewall at work and my dotnetnuke is up and running as it is only javascript.

DotNetNuke assumes that users who are granted permission to enter content are trusted and therefore will not be inclined to add malicious scripts to their sites. This model breaks down somewhat in areas where modules allow untrusted users to contribute content which will be redisplayed on the site - examples are forums, blog comments, etc... Regardless, you have a number of options to consider.

1. Make sure your portal permissions are configured appopriately so that only trusted users can enter content

2. Do not include modules which allow for user contributed content on your site

3. As a last resort, you could create your own custom "RichTextEditorProvider" which prevents the entry of all script. This would obviously limit the creativity of users on your site by preventing them from adding any type of text formatting ( ie. bold, italics, underline, paragraphs ) or reference external resources ( hyperlinks, pictures, etc... ) in their content.