extra filter for xss.

Signed-off-by: Ah-Lun Tang <tang@ahlun.be>