fix XSS