fixes xss js