fix XSS issue (same as 2e30b24)