fix xss bug, like nickname input