A3 – Preventing cross-site scripting