Added XSS in javascript