tutorial 34-35
force char encoding, xss prevention