Add cross-site scripting warning