fixing the XSS again, was only unquoting the first bad character, now all strange chars are gone