xss protection & encoding issue