Cross-Site Scripting: A 25-Year Threat That Is Still Going Strong