fix the easy XSS on public