  Cross Site Scripting (XSS) is one of the most critical vulnerabilities exist
in web applications. XSS can be prevented by encoding untrusted data that are
loaded into browser content of web applications. Security Application
Programming Interfaces (APIs) such as OWASP ESAPI provide output encoding
functionalities for programmers to use to protect their applications from XSS
attacks. However, XSS still being ranked as one of the most critical
vulnerabilities in web applications suggests that programmers are not
effectively using those APIs to encode untrusted data. Therefore, we conducted
an experimental study with 10 programmers where they attempted to fix XSS
vulnerabilities of a web application using the output encoding functionality of
OWASP ESAPI. Results revealed 3 types of mistakes that programmers made which
resulted in them failing to fix the application by removing XSS
vulnerabilities. We also identified 16 usability issues of OWASP ESAPI. We
identified that some of these usability issues as the reason for mistakes that
programmers made. Based on these results, we provided suggestions on how the
usability of output encoding APIs should be improved to give a better
experience to programmers.
