xss bug fix - style improvement