fixbug: xss; feature: POP, download txt