fixed XSS bug