added xss testing