add xss protection in notices