fix a xss issue