Add javascript to prevent cross-site scripting