added XSS protection to submitted URLs