very very basic xss detection