XSS fixed