Fixed possible XSS by escaping user input.