XSS cleaning, draft 2