add xss attack