fix sort and remove xss check