fixed xss issue