get rid of gaping XSS vulnerability