Patched an XSS and SQL vulnerability.

Reported by security researcher Alain Homewood, PwC, NZ.