fix xss load db