Write sanitised url into form action to prevent XSS.