xss fix from Steven Chamberlain