added more apc, fixed xss hole in template parameter validation