fix possible xss hole