another XSS patch

just client side XSS patch