fix. Bug #54 XSS.