Update api.php

XSS patch