Fixed XSS attack bug