Quite often one sees XSS attacks described that uses the aspect of writing HTML and JavaScript into form fields, which is then echo’d back to the browser. The problem here is that the application did not invest the additional development effort to validate all input, and in addition to HTML encode all output before sending it back to the browser.

There are a number of BSP test applications that fall into this category. With the next SPs, these applications will be rechecked, and the necessary HTML encoding will be added where needed.