improve xss RegExp