removed click event from html

security step to prevent common xss exploit