issue #181

#181 xss bug