add javascript's antiXSS