fix xss atack and hide controls
fix xss atack and avoid hide controls when push a button