OWASP - Web site security documents of worth

The owasp site is a great resource for web site security guide lines

http://www.owasp.org/

http://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

http://code.google.com/p/owasp-development-guide/wiki/WebAppSecDesignGuide_D6

Script injection attacks to be aware of

The following is an xss attack that few people release is possible;

<script>
alert('</script><script>alert(2);</script>');
alert('1');
</script>

How it works:
Its simple really the HTML parser of browsers first parse the HTML structure of the page, they have no knowledge of the structure of javascript and contents contained in the tag body. _ANY_ HTML tag, even one present in correctly escaped javascript takes precedence.