remove xss security hole in chat