prevent cross site scripting snippet