modify validation, xss sanitize