add action: combo; santitize params of combo action
fix a bug that will cause an error of express