fixed two xss bug