fixed xss bug
0.7.9