replacing check_plain() with filter_xss()