fixed html injection vulnerability, removed affix, and fixed NaN edge case