Reviewing Code for Cross-Site Scripting