fixed xss issues