Better solution to Javascript injection in URLs

Suggested by Kihou.