add XSS filter