fix xss security bug in highlighter function
add xss example