“For example, an application may attempt to defend against some cross-site scripting attacks by stripping the expression: < script > from any user-supplied data. However, an attacker may be able to bypass the filter by supplying the following input: < scr < script > ipt >”