but all data in the request, including hidden fields, cookies, headers, the URL itself, and
so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate
only fields that are expected to be redisplayed by the site. It is common to see data
from the request that is reflected by the application server or the application that the