scanner for xss and sql injection