http://www.cgisecurity.com/articles/xss-fa...faq.shtml#intro