Cross-Site Scripting for Non-Programmers: The Attack Hiding in Your Comment Box
Cross-site scripting turns your own pages against your visitors — no server break-in required. A plain-English explanation of how it works and what sanitization actually means.