fix xss escape
Merge branch 'hotfix'