Drupal security against XSS and SQL Injection