XSS injection HotFix

Thanks to the people who report this bug