The sample Blog application in the recess framework lacks strong input validation mechanism and is thus vulnerable to Cross-Site-Scripting attacks