added aditional xss prevention.