fixed possibility to perform XSS attack