Proper escaping for sitelist.

Can't see how this could have worked without. Did it?