prevent XSS query search