fix xss issue