A white paper about the possibility of ajax use in xss attacks http://barmagy.com/blogs/infinite_loop/archive/2007/07/13/475.aspx -- Fady Anwar