might be the introduction of XSS sequences into a web page that is generated;
however, the payload is not activated until an outside party visits the page with a web
browser that has scripting enabled.
Crossover, trigger, and activation points can also be very close together, which typically