fix tagcloud and xss