Testing for Cross-site Scripting