Add prevent before xss: encode dangerous chars