security fix <script> allowed when escaped