XSS code sniffer