should be the last of the xss issues