fix user query xss