http://lewanzu.com/2016/12/24/xss-protect/index.htm