prevent script tags in payment fields