Fixed a script injection vulnerability