Hmm I'm pretty sure we sanitize the urls, I'd like to run this through the html filter before printing out, just to be sure.