Can we create an entire site from just html and css without making it vulnerable to XXS