fix: chathistory.php XSS