Preventing Cross-Site Scripting with Script-Free HTML