add renderPartial and xss