entity_udpate: fix javascript injection

Signed-off-by: Bas Westerbaan <bas@westerbaan.name>