use strip & entities for XSS