ad a function to prevent xss