Fix security bug in form with XSS attack