Here is very usefull sites and you can find more information there about XSS(another vulnerabilities as well)http://www.exploit-db.com/www.packetstormsecurity.comhttp://en.wikipedia.org/wiki/Cross-site_scripting
Just search for XSS,Cross Site Scripting and you can find papers about it.
It is so simple: XSS is Client side Vulnerability(actually it is nothing does on server side)
But when that XSS 'payload' goes to client browser it will exploit.
In ex: Can steal User cookies and using that stealed cookies login to your administration pane without login + password)(You can find a lot of tonnes whitepapers 'how to learn hack')
In ex: Can redirect to malware sites which will try to exploitate client side vulnerabilities(in ex: Drive BY Download,Buffer Overflow in PDF readers,etc)
XSS+SQL injections are common vulnerabilities in web applications.
XSS-is not so harmfull in this case(But it depends on situation)
SQLI is more harmfull.And Serious.
My question is how does John attack my website? Or more important, how does he actually change files? If he were to have a log in
Well,John can find another type vulnerability or misconfiguration on your site.
In ex: Remote file Include,Local File include,Travelsal,SQLi,CSRF etc etc etc.
I will recommend to check all your Access and error logs for such suspic actions.(Log based investigation)
ssh>zgrep 'suspic goes here' *.gz|less
If you can't find anything well you need make sure your hosting is UP2DATE+correctly administering)
I would rather seem like a fool than program like one with holes in it
Acunetix is very usefull in this case)