fixed XSS issues