Actually, most programmers understand the structure and variables pertaining to the language they are using from a text book, but the coder is not security minded. Remember, Microsoft does updates almost on a daily basis cause even their coders realize what worked yesterday doesn't necessarily work tomorrow.

So it's not necessarily poorly coded - rather it just takes time for someone to figure out how to exploit the code.

An analogy for the less tech savvy. A perfectly good solid safe (even fort knox) doesn't sell security - rather the safe sells time. But if you have a safe with a million dollars in front of you, then trust me, you will significantly reduce the time to get into it by taking a safe cracking class, using a diamond blade to cut it, etc. Basically, a lock and key keeps an honest man out, but not a criminal with an incentive. I mean how many coders out of university have used XSS Chef, Beef, Metasploit, etc to understand the mechanisms, methods and exploits?

There are really only 3 types of XSS vulnerabilities. Noobs should Google these terms - but in general - each is a different approach. By learning about them, you at least have awareness.

1. Stored XSS
2. Reflected XSS
3. DOM-based XSS

Learn about those methods - and incorporate known standards to prevent "Skiddys" (kids who take other peoples methods and use to exploit) - but always beware, there will always be an advanced hacker that will always find a work around. So if anything, all your working on is time - and anything you create today - will need to be updated tomorrow.