XSS protection by doing input validation before persisting