fixed xss; add linebreak support