added code to prevent xss attack