It doesn't quite belong here ... but CERT has published a short overview of Cross Site Scripting and what you can do to avoid it:
CERT CSS overview
"To estimate the time it takes to do a task, estimate the time you think it should take, multiply by two, and change the unit of measure to the next highest unit. Thus we allocate two days for a one-hour task." -- Westheimer's Rule
If it doesn't belong here, why is it here? OK, not blaming you for anything, peace...
Why did they have to name it Cross Site Scripting, CSS... CSS stands also for Cascading Style Sheets...
Q: Why do computer scientists confuse Christmas and Halloween?
A: Because Oct 31 = Dec 25