simple tiny xss scanner