We have heard of Cross-Site Scripting attack....basically two types of cross site scripting is normally explained everywhere.. Non-Persistent CSS - which normally occurs when the input is directly echoed on the browser which causes the script in the input to execute. This script can steal the cookie using document.cookie and may post the values to attacker's site. Persistent CSS occurs when the input (from querystring, form variables) is stored in the database and later retrieved to display it on webpage causing the script to execute.
If we can use document.cookie so why not we use document object itself !! DOM based attack works on this principle..If our code uses document.url or document.location.href etc..these can be exploited using this technique.
In .NET, we can use requestValidate=True as page directive to prevent from such kind of attack. However this can also be bypassed, so also use HtmlEncode, UrlEncode to tightly filter input and write output urls. Also, a great library called IOSEC is available which goes further to filter malicious input.
For more info abt CSS:
http://www.webappsec.org/projects/articles/071105.shtml
http://crypto.stanford.edu/cs155/CSS.pdf
http://www.owasp.org/index.php/Category:OWASP_Project