fixed bugs, xss atacks