Fix an exploit in embed letting you inject HTML code

The commit description is wrong. Whatever.