xml param vulnerability workaround.