prevent attack from javascript and css injection #9