fix possible XSS with locales