fixed cross-site scripting errors