better xss logic