anchor.diff:              <legend>With JSP Output Escaping</legend>
               <label for="outputEscapedJSPName">Name</label>
               <input type="text" id="outputEscapedJSPName" name="outputEscapedJSPName" />
  -            <input type="submit" value=" Send" />
  +            <input type="submit" value="Send" />
           </fieldset>
       </form>
   
  
positive.code: <body>
  	<h1>Cross-Site Scripting (XSS)</h1>
  
      <p>Use &lt;script&gt;alert(document.cookie)&lt;/script&gt; as input to simulate a Cross-Site Scripting attack.</p>
  
      <form action="unprotected" id="unprotectedForm" method="post">
          <fieldset>
              <legend>Unprotected</legend>
              <label for="unprotectedName">Name</label>
              <input type="text" id="unprotectedName" name="unprotectedName" />
              <input type="submit" value=" Send" />
          </fieldset>
      </form>
  
  
negative.code:             <legend>With Input Validation</legend>
              <label for="inputValidatedName">Name</label>
              <input type="text" id="inputValidatedName" name="inputValidatedName" pattern="^[^<>]+$" />
              <input type="submit" value="Send" />
          </fieldset>
      </form>
  
  