The Design and Implementation of laffer1

http://www.informit.com/articles/article.asp?p=603037&rl=1

xss faq:
http://www.cgisecurity.com/articles/xss-faq.shtml