Avoiding XSS on IO data