Fixing XSS vulnerability