diff --git a/public/js/app.js b/public/js/app.js
index 819ca17..af10589 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -13,7 +13,6 @@ const App = {
 
   async init() {
     try { const s = await API.get('/install/status'); if (!s.installed) { location.hash = '#/install'; return; } } catch { location.hash = '#/install'; return; }
-    this.loadFooter();
     window.addEventListener('hashchange', () => this.route());
     this.route();
   },
@@ -85,7 +84,9 @@ const App = {
     const pub = document.getElementById('public-page');
     pub.classList.remove('hidden');
     const comp = page === 'login' ? LoginPage : page === 'register' ? RegisterPage : page === 'install' ? InstallPage : HomePage;
-    comp.render(param).then(html => { pub.innerHTML = html; if (comp.mount) comp.mount(param); });
+    comp.render(param).then(html => { pub.innerHTML = html; if (comp.mount) comp.mount(param); }).catch(() => {
+      pub.innerHTML = '<div class="pub-card"><div class="logo"><i class="fas fa-exclamation-triangle" style="color:var(--d)"></i><h2>加载失败</h2><p>请刷新页面重试</p></div></div>';
+    });
   },
 
   showLayout() {
@@ -93,7 +94,8 @@ const App = {
     document.getElementById('public-page').classList.add('hidden');
     document.getElementById('main-layout').classList.remove('hidden');
     const u = Auth.user();
-    document.getElementById('user-info').innerHTML = `<div class="av">${(u.game_name||u.username).charAt(0).toUpperCase()}</div><div class="dt"><div class="nm">${u.game_name||u.username}</div><div class="rl">${U.ROLE[u.role]}</div></div>`;
+    document.getElementById('user-info').innerHTML = `<div class="av">${U.esc(u.game_name||u.username).charAt(0).toUpperCase()}</div><div class="dt"><div class="nm">${U.esc(u.game_name||u.username)}</div><div class="rl">${U.ROLE[u.role]}</div></div>`;
+    this.loadFooter();
   },
 
   renderSidebar(current) {