add xss and sql injection test cases