Fix cross-site scripting vulnerability