A system that facilitates detecting security flaws in a web site that receives and transmits untrusted content is described herein. The system includes a receiver component that receives test content that corresponds to a field on a web page that, when the web site is online, is configured to receive user-generated content, wherein the test content includes non-malicious data. An encoder component encodes each character of the test content regardless of form or content of the test content to generate encoded content. A display component displays encoded content and non-encoded content of the web page to a tester on a computer screen, wherein the display component causes the encoded content to be displayed in a visually distinct manner from the non-encoded content.