xss functions and tests