add prevent script attack