fix xss bug