jsonp跨域时如何解决xss漏洞

$.ajax({
    type: "GET",
    url: "http://xxx.com/getData",
    dataType: "jsonp", 
    jsonp: "callbackParam", //自定义callback参数名称
    jsonpCallback:"getData", //自定义callback的js函数名
    success: function(data) {
        ...
    }
});

public function getData(){
    //指定返回的数据格式为json
    header("Content-type: application/json");

    $callback = $this->_param(‘callbackParam‘);

    //约定只接受某个js回调函数名
    if($callback != ‘getData‘) {
        $callback = ‘getData‘;
    }

    $data = array(...);

    echo $callback.‘(‘.json_encode($data).‘)‘;
    exit;
}