Fix XSS injection