xss_clean Input class. public is web root