Scanning for XSS flaws