fixed sec holes: xpath and sql inject