more xss regexp
manual one to many