refs #10467 , prevent xss attack