Fixed XSS bug