update wont be using xss filter either