How to search for xss with blacklisted html tags