Testing cross-site scripting