Staging XSS filter