URL parameter encoding to avoid XSS attacks