fixed XSS exploit in embed code