no need to minify
fix xss