Fix potential XSS in cuwo,js