add xss for username