Fixing possible xss vulnerability in ajax call