What loopholes in the code make XSS attacks possible?

• 代码中的哪些漏洞导致XSS攻击成为可能?