protect against XSS injection attacks