fixed possible XSS bug, thanks to dualbus