fixed possible xss vulnerability