fix XSS bug (might need more testing to be sure)