diff --git a/Gemfile b/Gemfile
index e91c3ae..e98efea 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,4 +1,4 @@
-source 'https://rubygems.org'
+source 'https://gems.ruby-china.org/'
 
 git_source(:github) do |repo_name|
   repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/")
@@ -44,6 +44,8 @@ group :development, :test do
   gem 'rspec-rails'
   # Call 'byebug' anywhere in the code to stop execution and get a debugger console
   gem 'byebug', platform: :mri
+  gem 'bundler-audit'
+  gem 'brakeman'
 end
 
 group :development do
diff --git a/Gemfile.lock b/Gemfile.lock
index 30c443b..58996fd 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,5 +1,5 @@
 GEM
-  remote: https://rubygems.org/
+  remote: https://gems.ruby-china.org/
   specs:
     actioncable (5.0.2)
       actionpack (= 5.0.2)
@@ -46,7 +46,11 @@ GEM
     bootstrap-sass (3.3.7)
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
+    brakeman (3.7.2)
     builder (3.2.3)
+    bundler-audit (0.6.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
     byebug (9.0.6)
     coffee-rails (4.2.1)
       coffee-script (>= 2.2.0)
@@ -192,6 +196,8 @@ PLATFORMS
 
 DEPENDENCIES
   bootstrap-sass
+  brakeman
+  bundler-audit
   byebug
   coffee-rails (~> 4.2)
   devise
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 682a07d..cd6ea53 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -1,6 +1,6 @@
 class ApplicationController < ActionController::Base
 
-  # protect_from_forgery with: :exception
+  protect_from_forgery with: :exception
 
   helper_method :current_cart
 
diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb
index 245dece..25e6184 100644
--- a/app/controllers/events_controller.rb
+++ b/app/controllers/events_controller.rb
@@ -9,10 +9,11 @@ def show
     @comments = @event.comments
 
     if params[:keyword]
-      @comments = @comments.where( "comments.content LIKE '%#{params[:keyword]}%'")
+      @comments = @comments.where( "comments.content LIKE ?", "%#{params[:keyword]}%")
+
     end
 
-    if params[:sort]
+    if params[:sort] && ["id DESC", "id ASC"].include?(params[:sort])  # 只有白名单内的参数可以用
       @comments = @comments.order(params[:sort])
     end
 
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index f1d232d..fd6cac4 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -21,7 +21,7 @@ def update
   protected
 
   def user_params
-    params.require(:user).permit(:nickname, :role)
+    params.require(:user).permit(:nickname)
   end
 
 end
diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb
index ed49051..9830ce7 100644
--- a/app/helpers/users_helper.rb
+++ b/app/helpers/users_helper.rb
@@ -7,9 +7,10 @@ def user_avatar_link(user)
     email_md5 = Digest::MD5.hexdigest(user.email)
     gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}"
 
-    str = "<div class ='user-link'>" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "</div>"
+   content_tag(:div,
+      link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name ,
+      :class => "user-link" )
 
-    str.html_safe
   end
 
 end
diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb
index 0e89067..d1b296e 100644
--- a/app/views/events/show.html.erb
+++ b/app/views/events/show.html.erb
@@ -22,14 +22,14 @@
     </div>
 
     <div class="panel-body">
-      <%= raw comment.content %>
+      <%=  sanitize comment.content %>
     </div>
 
     <div class="panel-footer text-right">
       <%= comment.created_at.to_s %>
 
       <% if current_user && current_user.is_admin? %>
-        <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :class => "btn btn-default" %>
+        <%= link_to "Highligh", highlight_event_comment_path(@event, comment),method: :post, :class => "btn btn-default" %>
       <% end %>
 
       <% if comment.can_deleted_by(current_user) %>
@@ -50,4 +50,4 @@
   <div class="form-group">
     <%= f.submit "Comment", :class => "btn btn-primary" %>
   </div>
-<% end %>
\ No newline at end of file
+<% end %>
diff --git a/config/routes.rb b/config/routes.rb
index 2cfd938..a5ccf3e 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -7,7 +7,7 @@
   resources :events do
     resources :comments do
       member do
-        get :highlight
+        post :highlight
       end
     end
   end