Bug fixed B65-ZK-1897: Possible Cross-site Scripting Vulnerability 
http://tracker.zkoss.org/browse/ZK-1897