xss hax more difficult