@nschonni you are right. I put this first to remove the ability to run script stuff in the popup. Should I keep the line featAtt.replace(/<\/?[^>]+>/gi, ''); but look for ```<script>```? The line I removed caused problem when user has a ```<a>``` tag inside the popup so I need to remove it. What do you think should I remove the 3 lines or look only for ```<script>``` tag?