My method may be exposed to cross site scripting attack c#

I think my method may be exposed to cross site scripting attack, I'm not sure. If yes then how can I test it? I tried to input script in the input fields and the submission wasn't success so I'm guessing it's handled but I may be wrong. Is there any other way to verify?

Code:

private void SendRequest(string ID, byte[] pass, string passwordUnencrypted, string Message, string sEncodedRequest, string UniqueCallStr, DateTime StartingTime, SqlConnection objConn)
{
    string Message = "Test";

    Client.Message = "T";
    try
    {
        string OBJECTXML = "<OBJECT name=”class” op=”operation”>    <inputname>value</inputname>    </OBJECT>";
        OBJECTXML = Encoding.ASCII.GetString(Convert.FromBase64String(sEncodedRequest));
        string sessionid = "sessionid=" + '"' + "sessionid???" + '"';
        sessionid = "";

        string userid = this.ClientInfo.ClinUser;
        string password = this.ClientInfo.ClinPass;
        string facilityid = "4";

        string xmlrequest = "<?xml version='1.0'?><REQUEST " + sessionid + " userid=" + '"' + userid + '"' + " password=" + '"' + password + '"' + " facility=" + '"' + facilityid + '"' + " >" +
            OBJECTXML + "</REQUEST>";

        xmlrequest = "<?xml version='1.0'?><REQUEST " + sessionid + " userid=" + '"' + userid + '"' + " password=" + '"' + password + '"' + " >" +
            OBJECTXML + "</REQUEST>";
        HttpWebRequest httpWReq =
            (HttpWebRequest)WebRequest.Create("url");
        ASCIIEncoding encoding = new ASCIIEncoding();
        TestDBGstr.Append("Data Sent:(").Append(xmlrequest).Append(")");
        string postData = "request=" + xmlrequest;
        byte[] data = encoding.GetBytes(postData);

        httpWReq.Method = "POST";
        httpWReq.ContentType = "application/x-www-form-urlencoded";
        httpWReq.ContentLength = data.Length;

        using (System.IO.Stream stream = httpWReq.GetRequestStream())
        {
            stream.Write(data, 0, data.Length);
        }

        HttpWebResponse response = (HttpWebResponse)httpWReq.GetResponse();

        string responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();

        XmlDocument xmlDoc = new XmlDocument { XmlResolver = null };
        xmlDoc.LoadXml(responseString);
        string SessionId = "";
        try
        {
            SessionId = xmlDoc.DocumentElement.Attributes["sessionid"].Value;
        }

        if (xmlDoc.DocumentElement.Name.ToUpper().Equals("ERROR"))
        {
            responseString = xmlDoc.DocumentElement.InnerText;"
            globalStatus.ItsReturn.ErrorCode = 9;
        }
        else if (xmlDoc.DocumentElement.Name.ToUpper().Equals("RESULT"))
        {
            globalStatus.ItsReturn.ErrorCode = 0;
        }

        globalStatus.ItsReturn.Response = Convert.ToBase64String(Encoding.ASCII.GetBytes(responseString));
    }
}