fix XSS and add command parser