how to find problems?

Do you know what is the best way for finding vulnerabilities such as SQL injection and cross-site scripting (XSS)?

The best way to find vulnerabilities is you can use some kind of application security testing tools so that you can find out the vulnerabilities in the websites coding and database. Or you can do it by yourself if you are a professional developer.