add xss/ajax