fix XSS, colors