fix bug XSSVulnerability