Fix tipping XSS (joseph)