Fix XSS and add case insensitive for TAG