Better XSS removal