Fix XSS vulnerability