Fix a few edge cases for XSS