prevent XSS in registration