updated description with owasp one
turning off whitelisting and entities encoding