add XSS cleaning - we never ever trust foreign input introduced to our PHP code