XSS include fix