Is not displaying output enough to prevent link injection cross-site scripting?
===

I'm new to dealing with cross-site scripting problems. We have some 404 pages that output the not found URL where, from what I learned, javascript can be maliciously substituted. To prevent an XSS attack, is it enough to simply remove the outputting of the bad URL? Or do I still need to somehow filter the input against a whitelist, for which I was looking at the OWASP library: https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API