Add XSS prevention