You are right that was very silly of me. I got some real XSS filter instead.