My set of opinion on security and XSS:
- Rule of programming: You can't know everything. Sooner or later you are going to make a mistake.
- Rule of programmer: A programmer works 12h a day: 3 is discussing with other programmers random things, 3 is thinking at other things, 3 is discussing on what it should code, 3 it's programming .... projects are made for 12h a day of almost non stop programing.
- XSS is simple. And there are a lot of inputs waiting for XSS.
- Security still comes last and most of the time is seen as a deficient.