xml pages xss proof