fixed security issue getParameter()