escape_output instead of rawurlencode usernames
move <script> to footer