add xss source code