If a malicious people go into the sign in form and put in the fields First Name, Last Name and Nick Name a code like this:
<script>alert("XSS")</script>

when you load the page http://www.example.com/[path]/guestbook.php or you read the messages of the guestbook you will se a pop-up that "say"
'XSS'.

]