fixed replace security flaw
merge