fixed xss bug