fix xss attack