fix XSS and SQL injections