Lately, have become interested in XSS and its prevention methods. Most of the XSS prevention techniques focus on sanitizing the input for invalid characters and using them. This raises a question:
When it is obvious that the purpose is indeed an XSS attack why are we trying to strip the invalid characters and then going ahead with using the input instead of directly rejecting the input as such and sending the usage to an error page?
Am sure that everyone would have thought of this approach but somehow focus is on input validation,filtering and reusing instead of rejection. Why? What am I missing here?