fix filters of URI and CSS
replace suspicious code with string "XSS" to avoid recursion replacement tricks