add xss filter
delete xss filter