remove XSS vulnerability based on 207543754c4e7a6b1266952d846dc5c254b9a3d3