Confirm is_submission flag out of URL + validation for XSS + Prevent directory listings