refacto & xss filter