Preventing XSS on user variable