99 - PV - XSS prevention - from Pen Test

Fixed the javascript will execute in letter & splashpage & myibd