fix xss injections