Fixed XSS without double encoding