xss & sqlinjection functional tests