add upload
fix xss name