XSS prevention on user name