fix a XSS bug