Fixed the cross-site scripting issue by not using an entire URL