fixed possible script injection bug