xss fixed