user created content makes secured from XSS