fix another vulberability <script>alert('test')</script> now not working...

... anymore