add sanitization to protect DOM based XSS