Cross Site Scripting fixed