fix for xss