ack, potential XSS vector here