update
delete
buttons
fix an xss