XSS attack fix