XSS fix