update + xss fix