DOM-Based Cross-Site Scripting

I am not very familiar with DOM-Based Cross-Site Scripting but have been informed that the following lines of code (taken from a .js file) below are leaving my site vulnerable:

document.write("<PARAM NAME=FlashyVars VALUE='" + strFlashyVars + "'>");

Does anyone know how this could be manipulated or remedied?

Thanks,

cj