Which of the following MUST a programmer implement to prevent cross-site scripting?

Which of the following MUST a programmer implement to prevent cross-site scripting?

A.
Validate input to remove shell scripts

B.
Validate input to remove hypertext

C.
Validate input to remove batch files

D.
Validate input to remove Java bit code