complete XSS and JS injection protection