eliminate notices
fix XSS