fix XSS vulnerability