You need to ensure that all user supplied input sent back to the browser is verified to be safe (via input validation), and that user input is properly escaped before it is included in the output page. Proper output encoding ensures that such input is always treated as text in the browser, rather than active content that might get executed.
Web 2.0 technologies, such as AJAX, make XSS much more difficult to detect via automated tools.
Preventing XSS requires keeping untrusted data separate from active browser content.
The application uses untrusted data in the construction of the following HTML snippet without validation or escaping:
The attacker modifies the ‘CC’ parameter in their browser to:
This causes the victim’s session ID to be sent to the attacker’s website, allowing the attacker to hijack the user’s current session.
Note that attackers can also use XSS to defeat any automated CSRF defense the application might employ. See A5 for info on CSRF.