Fix XSS bug (thanks @CodeBlock).