added basic xss protection