Filtering $user to prevent more XSS