added xss
merge