XSSed is a set of XSS vulnerable PHP pages for testing (and fun, don't forget the fun).
A set of XSS vulnerable PHP scripts for testing