fix bugs

fix XSS bug
edit language
fix db error if you use ' or "