fix xss #7