When XSS was pointed out during a code review, I knew how to fix it, but I didn't understand why I had written it that way in ...