Fix XSS. Check input on server side