add xss filter for search function