added infor on XSS attacks