fixed xss, thanks sloth