fix XSS bug