possible fix for xss