Prevent xss in client_api