add security for xss