url or params is full of illegal XSS character