fixed cross site scripting vulneradility (Bug #52)