updated for XSS to work