fixed a bad url
Made code more secure by quoting input strings and only allowing legal values