Fix XSS in transliterated output.