Fix XSS exploit in embed