added basic defense against xss