Fix XSS and SQL injection