Fix a vulnerability in not correctly sanatising an HTML parameter