fix xss issue, found thanks to jvoisin