more complicated xss check example