fix all (hopefully) xss