repair a xss loophole