xss filter set to true, and username password add htmlspecialchar to prevent sql injection and xss attack