diff --git a/app/admin/view/xhprof/run/index.js b/app/admin/view/xhprof/run/index.js
index 7bae649..ca9e7cb 100644
--- a/app/admin/view/xhprof/run/index.js
+++ b/app/admin/view/xhprof/run/index.js
@@ -16,7 +16,6 @@ $(function () {
     ua.table.render({
         init: init,
         toolbar: [],
-        defaultToolbar: ['filter'],
         cols: [[
             {field: 'request_time', title: '请求时间', width: 170, sort: true, search: 'range', templet: formatRequestTime},
             {
@@ -40,9 +39,11 @@ $(function () {
             },
             {
                 field: 'url', title: 'URL', minWidth: 220, searchOp: '%*%', templet: function (d) {
-                    var u = d.url || '';
+                    var u = String(d.url || '');
+                    var esc = u.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
                     var short = u.length > 50 ? u.substring(0, 50) + '…' : u;
-                    return '<span title="' + u.replace(/"/g, '&quot;') + '">' + (short === '' ? '/' : short) + '</span>';
+                    short = short.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+                    return '<span title="' + esc + '">' + (short === '' ? '/' : short) + '</span>';
                 }
             },
             {field: 'node_id', title: '节点', width: 160, search: 'select', searchOp: '=', selectList: ua.getDataBrage('select_list_node_id') || {}},
diff --git a/app/admin/view/xhprof/run/read.html b/app/admin/view/xhprof/run/read.html
index 14d0f75..8e61932 100644
--- a/app/admin/view/xhprof/run/read.html
+++ b/app/admin/view/xhprof/run/read.html
@@ -32,7 +32,7 @@
                                 <div class="detail-field-label">请求完整 URL（超长截断）</div>
                                 <div class="detail-field-value">
                                     {notempty name="row.url"}
-                                    {$row.url}
+                                    {$row.url|htmlspecialchars=###,ENT_QUOTES,'UTF-8'}
                                     {else/}
                                     <span class="layui-text-em">暂无数据</span>
                                     {/notempty}
@@ -42,7 +42,7 @@
                                 <div class="detail-field-label">规范化 URL（去 query、数字段替换，聚合用）</div>
                                 <div class="detail-field-value">
                                     {notempty name="row.simple_url"}
-                                    {$row.simple_url}
+                                    {$row.simple_url|htmlspecialchars=###,ENT_QUOTES,'UTF-8'}
                                     {else/}
                                     <span class="layui-text-em">暂无数据</span>
                                     {/notempty}
diff --git a/app/admin/view/xhprof/run_watch/index.js b/app/admin/view/xhprof/run_watch/index.js
index 67fc3fb..c878060 100644
--- a/app/admin/view/xhprof/run_watch/index.js
+++ b/app/admin/view/xhprof/run_watch/index.js
@@ -2,7 +2,6 @@ $(function(){
      ua.table.render({
         init: init,
         toolbar: [],
-        defaultToolbar: ['filter'],
         cols: [[
             {field: 'id', title: 'ID', width: 80, sort: true},
             {field: 'watch_id', title: '监控规则', width: 160, search: 'select', searchOp: '=', selectList: ua.getDataBrage('select_list_watch'), templet: function(d) {
diff --git a/app/admin/view/xhprof/run_watch/read.html b/app/admin/view/xhprof/run_watch/read.html
index 6c74f8d..6a94292 100644
--- a/app/admin/view/xhprof/run_watch/read.html
+++ b/app/admin/view/xhprof/run_watch/read.html
@@ -62,7 +62,7 @@
                                 <div class="detail-field-label">请求 URL</div>
                                 <div class="detail-field-value">
                                     {notempty name="row.run.url"}
-                                    {$row.run.url}
+                                    {$row.run.url|htmlspecialchars=###,ENT_QUOTES,'UTF-8'}
                                     {else/}
                                     <span class="layui-text-em">暂无数据</span>
                                     {/notempty}
diff --git a/app/admin/view/xhprof/watch/add.js b/app/admin/view/xhprof/watch/add.js
index 75497d6..46c3a98 100644
--- a/app/admin/view/xhprof/watch/add.js
+++ b/app/admin/view/xhprof/watch/add.js
@@ -1,6 +1,7 @@
 $(function(){
     // PCRE 正则前端预校验：必须带定界符（权威校验在后端 @preg_match）
-    var form = window.UA_CORE.form;
+    // layui.form 本体在 tab iframe 中同步可用；window.UA_CORE 依赖 admin-core.js 的 IIFE 执行时序，存在竞态，此处不可使用
+    var form = layui.form;
     if (form) {
         form.verify({
             watchRegex: function (value) {
diff --git a/app/admin/view/xhprof/watch/edit.js b/app/admin/view/xhprof/watch/edit.js
index 75497d6..46c3a98 100644
--- a/app/admin/view/xhprof/watch/edit.js
+++ b/app/admin/view/xhprof/watch/edit.js
@@ -1,6 +1,7 @@
 $(function(){
     // PCRE 正则前端预校验：必须带定界符（权威校验在后端 @preg_match）
-    var form = window.UA_CORE.form;
+    // layui.form 本体在 tab iframe 中同步可用；window.UA_CORE 依赖 admin-core.js 的 IIFE 执行时序，存在竞态，此处不可使用
+    var form = layui.form;
     if (form) {
         form.verify({
             watchRegex: function (value) {