I am working on a Drupal 7 site that uses a replacement pattern %1 inside a View header to generate a URL with the Organic Group id(og_group_ref).
The view header markup is
<a class="ct" href="/node/add/post?og_group_ref=%1">Create Convo</a>
Example URL of a page is site/b_posts/2, so the link created would be /node/add/post?og_group_ref=2.
This is vulnerable to XSS, since accessing the URL site/b_posts/%22%20onmouseover=%22alert%28559%29%22%20test=%22/2 would result in a JS alert getting executed on mousing over the link. How to protect against this? I used the latest version of Views and this is still happening.