'strict' mode added and eval removed for XSS hack