Reflected XSS vulnerability fix