Testing XSS vulnerabilites