remove XSS attack in birthday mode