add some extra xss protection, fix some promotion adapter bug