fixed a fail to adequately sanitize request strings of malicious JavaScript #30