suppress XSS risk