fix xss prevent