security for XSS when accessing member via array-access.