minor fix anti xss