fix XSS fix