Properly deal with xss threat... maybe?