Fixed XSS and added &amp; except of &