deal with xss