Why can vendors produce a patch that prevents servers from accepting script as input?
The chief problem here is that the server can’t always tell what constitutes script and what doesn’t. The script will execute on the browser, and there could be additional scripting languages available there, different character sets in use, and so forth. Without knowing what the browser will consider to be script, the server cannot strip it out.
