Fix xss